bazarloader | 081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1

Analysis

max time kernel
132s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 22:39

Target

efad3e8098fdc4778d1744abb659fb04_JaffaCakes118.dll
Size

537KB
MD5

efad3e8098fdc4778d1744abb659fb04
SHA1

90e28ff7cc0cc20ae2f10652f9ffda01107470ed
SHA256

081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1
SHA512

a203e6084df1fde1f037bf7071a901541cfed9e18f5924c3ee47176bba2256774774fb08214520792b0603aa9784836d58fc55b38c7d987cec8a9d1be8a83783
SSDEEP

12288:DXI/lsYS/im/YnmCPksStIYotSPNwGG+Sft:DX67zmCPksUIYMO+GG+U

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5012-0-0x000002793FDA0000-0x000002793FDCA000-memory.dmp	BazarLoaderVar5
behavioral2/memory/5012-1-0x000002793FDA0000-0x000002793FDCA000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

51 5012 rundll32.exe
52 5012 rundll32.exe

flow	pid	process
51	5012	rundll32.exe
52	5012	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efad3e8098fdc4778d1744abb659fb04_JaffaCakes118.dll,#1
1⤵
- Blocklisted process makes network request
PID:5012

memory/5012-0-0x000002793FDA0000-0x000002793FDCA000-memory.dmp

Filesize
168KB

Download
memory/5012-1-0x000002793FDA0000-0x000002793FDCA000-memory.dmp

Filesize
168KB

Download