bazarloader | 4246dbf6daf37bac0e525bdd8122131bedf4e32f9542c4696fa525e1f71a6508

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 10:34

Target

4246dbf6daf37bac0e525bdd8122131bedf4e32f9542c4696fa525e1f71a6508.dll
Size

518KB
MD5

864216049e3b5a1d304698b1ff2b6fd7
SHA1

d6af38efd9e643e713f69b0b9232ce3429dc5cfd
SHA256

4246dbf6daf37bac0e525bdd8122131bedf4e32f9542c4696fa525e1f71a6508
SHA512

29378250d9626f7e95360fe0b07efb0773db774017c6f1afae0977d7a969b71601324446d112adf5859ae56d74b10464593e971a0ddc8ad0c51616230bfb458a
SSDEEP

6144:UaKkPCwpcE4EiftUViAstzAqsK7nSSyrKwbCU:liwpZjYWHsXLSSy

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Bazar/Team9 Loader payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/624-0-0x0000000180000000-0x0000000180034000-memory.dmp BazarLoaderVar5

resource	yara_rule
behavioral1/memory/624-0-0x0000000180000000-0x0000000180034000-memory.dmp	BazarLoaderVar5

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2380 wrote to memory of 624	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 624	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 624	2380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4246dbf6daf37bac0e525bdd8122131bedf4e32f9542c4696fa525e1f71a6508.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4246dbf6daf37bac0e525bdd8122131bedf4e32f9542c4696fa525e1f71a6508.dll,#1
2⤵
PID:624

memory/624-7-0x000007FEF6A10000-0x000007FEF6A9A000-memory.dmp

Filesize
552KB

Download
memory/624-0-0x0000000180000000-0x0000000180034000-memory.dmp

Filesize
208KB

Download
memory/624-9-0x000007FEF6A10000-0x000007FEF6A9A000-memory.dmp

Filesize
552KB

Download
memory/2380-1-0x000007FEF6F50000-0x000007FEF6FDA000-memory.dmp

Filesize
552KB

Download
memory/2380-5-0x000007FEF6F50000-0x000007FEF6FDA000-memory.dmp

Filesize
552KB

Download
memory/2380-3-0x000007FEF6A10000-0x000007FEF6A9A000-memory.dmp

Filesize
552KB

Download