bazarloader | 1be9c4bac9d5b347464e5b870a50aa2b28e6598f3f4e34863b4f806543abe4ed

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 09:29

Target

b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe
Size

154KB
MD5

b2efe07dd68da755d79b49686971facd
SHA1

69ebafcb5e59c406aad22409006a62df741b2d40
SHA256

1be9c4bac9d5b347464e5b870a50aa2b28e6598f3f4e34863b4f806543abe4ed
SHA512

4ae1b3eb49e1d9ca70c92a5d58daae769d3b3232e2d9b6c53defce5d3675010138890b019706b2ef197666e71d02ed7ea4a36887bca3d88dbe288e5dc960270e
SSDEEP

3072:gV4JkQogL/GP/0I/f57Jamii72FuSWsN5aac+a3v:pSQolXz/fpz37Q5Xa3v

Score

10^/10

Bazar Loader 3 IoCs

Detected loader normally used to deploy BazarBackdoor malware.

description	flow	ioc	Process
Key created		\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\SystemCertificates\My	b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe
HTTP URL	16	https://46.17.107.111/api/v129	Process not Found
HTTP URL	21	https://212.80.219.191/api/v129	Process not Found

Tries to connect to .bazar domain 2 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

description	flow	ioc
HTTP URL	16	https://46.17.107.111/api/v129
HTTP URL	21	https://212.80.219.191/api/v129

C:\Users\Admin\AppData\Local\Temp\b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe"
1⤵
- Bazar Loader
PID:1644

C:\Users\Admin\AppData\Local\Temp\CabF9FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit