Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 03:16
General
-
Target
JaffaCakes118_774b4f307e5d546d3fed89eaa69c7689.dll
-
Size
536KB
-
MD5
774b4f307e5d546d3fed89eaa69c7689
-
SHA1
382c1e3b75d68bcf11679b16ee1ac589b3b94519
-
SHA256
b85a259abb357649a86a54681283820624e161ec2334707546e29998af231316
-
SHA512
c4c8b6cf113fe67de358c677d13828539c51ce7ba594d368131d247f72c00db23c511d6681e2380eb5a620ab7b993e9ae5d880f075c7d2ed65e7ffea2d2b0a9f
-
SSDEEP
12288:2d6RYg1Xc5E7lrYedtkot366KfwiY/Bs7h/M:C6/t7lrYedtkMn/Bsi
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazarloader family
-
Bazar/Team9 Loader payload 2 IoCs
-
Blocklisted process makes network request 15 IoCs
-
Tries to connect to .bazar domain 8 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_774b4f307e5d546d3fed89eaa69c7689.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
168KB