bazarloader | 878042c415ec1cb62d14e8b0f79fce6838e0813790546f7dd20eae65e9b9c8a2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 05:38

Target

1.dll
Size

363KB
MD5

7162fdf107c2d36f99c59d5435a4d399
SHA1

b4ffeac7e7b25409b709377430dfe8821ca21e6e
SHA256

1f9f8cf325ff2de752478ff0623086019ebd1ffbce1d1c2f60e0b70149279f10
SHA512

4098f01ba4da3742e96a70cf2478c26d8a24db1c97b048d27c40cb4f28c221c180ae356536b5bda41d9d041aa029dc951a90cd7fa038a5a7bc4c4d27a7fa95f8
SSDEEP

6144:RM8CPvvwq0YslcteDNCfgQ/Fkp8HuubxwHdy/6E6OuUNkTf:kvvwTYslTMIQQubxTNkD

Score

10^/10

Family

bazarloader

167.172.108.158

64.227.66.10

134.209.91.22

167.172.108.213

blackrain15.bazar

reddew28c.bazar

bluehail.bazar

whitestorm9p.bazar

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4688	5068	rundll32.exe	98
PID 5068 wrote to memory of 4688	5068	rundll32.exe	98
PID 4688 wrote to memory of 3608	4688	cmd.exe	100
PID 4688 wrote to memory of 3608	4688	cmd.exe	100
PID 4688 wrote to memory of 3548	4688	cmd.exe	101
PID 4688 wrote to memory of 3548	4688	cmd.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\system32\cmd.exe
  cmd /c choice /c y /d y /t 10 & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\1.dll", #1 pfabigas liarrrav & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\choice.exe
    choice /c y /d y /t 10
    3⤵
    PID:3608
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\1.dll", #1 pfabigas liarrrav
    3⤵
    PID:3548

memory/3548-2-0x0000022EB9D30000-0x0000022EB9D4F000-memory.dmp

Filesize
124KB

Download
memory/3548-3-0x0000022EB9D30000-0x0000022EB9D4F000-memory.dmp

Filesize
124KB

Download
memory/5068-0-0x000001F201B50000-0x000001F201B6F000-memory.dmp

Filesize
124KB

Download
memory/5068-1-0x000001F201B50000-0x000001F201B6F000-memory.dmp

Filesize
124KB

Download