bazarloader | 878042c415ec1cb62d14e8b0f79fce6838e0813790546f7dd20eae65e9b9c8a2 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 05:38

Sharing

Report Analysis Logs

General

Target

1.dll
Size

363KB
MD5

7162fdf107c2d36f99c59d5435a4d399
SHA1

b4ffeac7e7b25409b709377430dfe8821ca21e6e
SHA256

1f9f8cf325ff2de752478ff0623086019ebd1ffbce1d1c2f60e0b70149279f10
SHA512

4098f01ba4da3742e96a70cf2478c26d8a24db1c97b048d27c40cb4f28c221c180ae356536b5bda41d9d041aa029dc951a90cd7fa038a5a7bc4c4d27a7fa95f8
SSDEEP

6144:RM8CPvvwq0YslcteDNCfgQ/Fkp8HuubxwHdy/6E6OuUNkTf:kvvwTYslTMIQQubxTNkD

Score

10^/10

bazarloader dropper loader

Malware Config

Extracted

Family

bazarloader

C2

167.172.108.158

64.227.66.10

134.209.91.22

167.172.108.213

blackrain15.bazar

reddew28c.bazar

bluehail.bazar

whitestorm9p.bazar

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 5068 wrote to memory of 4688	5068	rundll32.exe	cmd.exe
PID 5068 wrote to memory of 4688	5068	rundll32.exe	cmd.exe
PID 4688 wrote to memory of 3608	4688	cmd.exe	choice.exe
PID 4688 wrote to memory of 3608	4688	cmd.exe	choice.exe
PID 4688 wrote to memory of 3548	4688	cmd.exe	rundll32.exe
PID 4688 wrote to memory of 3548	4688	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\system32\cmd.exe
cmd /c choice /c y /d y /t 10 & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\1.dll", #1 pfabigas liarrrav & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\system32\choice.exe
choice /c y /d y /t 10
3⤵
PID:3608

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\1.dll", #1 pfabigas liarrrav
3⤵
PID:3548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3548-2-0x0000022EB9D30000-0x0000022EB9D4F000-memory.dmp

Filesize
124KB

Download
memory/3548-3-0x0000022EB9D30000-0x0000022EB9D4F000-memory.dmp

Filesize
124KB

Download
memory/5068-0-0x000001F201B50000-0x000001F201B6F000-memory.dmp

Filesize
124KB

Download
memory/5068-1-0x000001F201B50000-0x000001F201B6F000-memory.dmp

Filesize
124KB

Download