Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-10-2024 20:55
General
-
Target
2552f71685c4bd3379ebc4f971bf26c6_JaffaCakes118.dll
-
Size
937KB
-
MD5
2552f71685c4bd3379ebc4f971bf26c6
-
SHA1
c610f0d02412a6e4f34c83ec293e737d0579c407
-
SHA256
612f74d0a1f2f90a5a4ae11889755ea68656967cf0401e15d9c375ddcfb1d9e7
-
SHA512
3ca8e82cd62f1d1bbc1ae243c0e801e71bf4b1a7ed1d3a2eaaa0c0b30150e4d59957361f0d17c810b077657d484b63d0b878bea957662da83fa29ed39a5c7693
-
SSDEEP
12288:XNCXFv5G77xLH0PpGzHcHDN2gt2FbSe7ABgnjpTDGAmWjgU:E1h02sz8jN25kegGjtBJ
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
128.199.54.51
161.35.152.204
161.35.95.166
whitestorm9p.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 5 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2552f71685c4bd3379ebc4f971bf26c6_JaffaCakes118.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2552f71685c4bd3379ebc4f971bf26c6_JaffaCakes118.dll,StartW {02811D6A-0489-4823-A213-E7B6B0D61F76}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB