Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 03:18
General
-
Target
d1e29954a320282f523cc4a6a22566ad06f944a4d6a5951449a582aba9bad0dc.dll
-
Size
488KB
-
MD5
fe48124be0ca6fa9c229d8f3c3f5feff
-
SHA1
41140ac806f014ed4e39f90530a190453d4d93f3
-
SHA256
d1e29954a320282f523cc4a6a22566ad06f944a4d6a5951449a582aba9bad0dc
-
SHA512
e09db30e3e399c4c4c17a7ae444eb93268bead99ad13bdb623ef875be0a458eefdccbafe477b5d11025711fc17007841b6d5ca60e1ceb1f6b434b28d11fd4637
-
SSDEEP
12288:t4qtPlcaE5Lnek6Aql6esonlkhssKDSZO:CelI5f6Aql6es6osWZO
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
162.33.178.121
162.33.178.246
162.33.177.25
162.33.178.119
reddew28c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d1e29954a320282f523cc4a6a22566ad06f944a4d6a5951449a582aba9bad0dc.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1e29954a320282f523cc4a6a22566ad06f944a4d6a5951449a582aba9bad0dc.dll,DllRegisterServer {87A1FD0F-83ED-4461-B37F-987214178EB4}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB