Analysis
-
max time kernel
96s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 18:29
General
-
Target
7a21ac421ac431d03661d7174979e5779dec4af541e266f0ea26a19464724ba1N.dll
-
Size
468KB
-
MD5
6ef155a647229c545ff442c277875720
-
SHA1
57bb9742d73637a890353e4d7d304c0cff9e9b6f
-
SHA256
7a21ac421ac431d03661d7174979e5779dec4af541e266f0ea26a19464724ba1
-
SHA512
1498d73914ddab7922d81073153cf266a3dc66fc9f8ff89c3c00635790376781ad4fefce2fc3e927cc36d343dc31c9b280add02bc53357c3a3fb2ae0e325f19c
-
SSDEEP
6144:spcTkE9fx04tFNlbCnZB/eLf2cdw2bnrohbz42D8Mh6kEQi:sWe4tFDbCnDeLnnroxOMokri
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
162.33.179.253
162.33.178.65
whitestorm9p.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7a21ac421ac431d03661d7174979e5779dec4af541e266f0ea26a19464724ba1N.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a21ac421ac431d03661d7174979e5779dec4af541e266f0ea26a19464724ba1N.dll,DllRegisterServer {454C6754-64DE-4A36-A7B3-8BE448013B5A}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB