bazarloader | 1be9c4bac9d5b347464e5b870a50aa2b28e6598f3f4e34863b4f806543abe4ed

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 09:29

Target

b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe
Size

154KB
MD5

b2efe07dd68da755d79b49686971facd
SHA1

69ebafcb5e59c406aad22409006a62df741b2d40
SHA256

1be9c4bac9d5b347464e5b870a50aa2b28e6598f3f4e34863b4f806543abe4ed
SHA512

4ae1b3eb49e1d9ca70c92a5d58daae769d3b3232e2d9b6c53defce5d3675010138890b019706b2ef197666e71d02ed7ea4a36887bca3d88dbe288e5dc960270e
SSDEEP

3072:gV4JkQogL/GP/0I/f57Jamii72FuSWsN5aac+a3v:pSQolXz/fpz37Q5Xa3v

Score

10^/10

Bazar Loader 3 IoCs

Detected loader normally used to deploy BazarBackdoor malware.

description	flow	ioc	Process
Key created		\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\SystemCertificates\CA	b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe
HTTP URL	51	https://46.17.107.111/api/v129	Process not Found
HTTP URL	58	https://212.80.219.191/api/v129	Process not Found

Tries to connect to .bazar domain 2 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

description	flow	ioc
HTTP URL	51	https://46.17.107.111/api/v129
HTTP URL	58	https://212.80.219.191/api/v129

C:\Users\Admin\AppData\Local\Temp\b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2efe07dd68da755d79b49686971facd_JaffaCakes118.exe"
1⤵
- Bazar Loader
PID:4048