bazarloader | 9d91621ca1c2a3bca8c74836bde3fbb8afbbc7c657f6630fd338fce8d8250965

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 04:23

Target

d52f5da10e84853f15706133e967ab6b.dll
Size

1.3MB
MD5

d52f5da10e84853f15706133e967ab6b
SHA1

e89558c040cc24b38a79e29f5b3fb8fe1e6300b9
SHA256

9d91621ca1c2a3bca8c74836bde3fbb8afbbc7c657f6630fd338fce8d8250965
SHA512

aa8a3500b4417271117a6acb3fa09485cb01a6eef1ebc9d5107a87155cfddf404139714e8ef9254c3a0076c6ca4a8a94ccd6a0c12434059b941d7b3de6569d99
SSDEEP

24576:bhCbYfOMaeAgeLut7oFGaDxcA7vw/9EYabCo:bcbYfGFBVxcA8V5aZ

Score

10^/10

Family

bazarloader

164.90.198.93

64.225.105.147

blackrain15.bazar

reddew28c.bazar

whitestorm9p.bazar

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4092-1-0x0000000180000000-0x0000000180015000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4092-7-0x0000000180000000-0x0000000180015000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4092-11-0x0000000180000000-0x0000000180015000-memory.dmp	BazarLoaderVar6

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

4092 regsvr32.exe
4092 regsvr32.exe
672 rundll32.exe
672 rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2728 wrote to memory of 4092	2728	regsvr32.exe	regsvr32.exe
PID 2728 wrote to memory of 4092	2728	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d52f5da10e84853f15706133e967ab6b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d52f5da10e84853f15706133e967ab6b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\d52f5da10e84853f15706133e967ab6b.dll,DllRegisterServer {E06C575A-A162-49F0-B49F-F112D9BB0D96}
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:672

memory/672-9-0x00007FF9D12A0000-0x00007FF9D13FF000-memory.dmp

Filesize
1.4MB

Download
memory/672-12-0x00007FF9D12A0000-0x00007FF9D13FF000-memory.dmp

Filesize
1.4MB

Download
memory/2728-0-0x00007FF9D12A0000-0x00007FF9D13FF000-memory.dmp

Filesize
1.4MB

Download
memory/2728-8-0x00007FF9D12A0000-0x00007FF9D13FF000-memory.dmp

Filesize
1.4MB

Download
memory/4092-1-0x0000000180000000-0x0000000180015000-memory.dmp

Filesize
84KB

Download
memory/4092-2-0x00007FF9D12A0000-0x00007FF9D13FF000-memory.dmp

Filesize
1.4MB

Download
memory/4092-7-0x0000000180000000-0x0000000180015000-memory.dmp

Filesize
84KB

Download
memory/4092-10-0x00007FF9D12A0000-0x00007FF9D13FF000-memory.dmp

Filesize
1.4MB

Download
memory/4092-11-0x0000000180000000-0x0000000180015000-memory.dmp

Filesize
84KB

Download