Overview

overview

10

Static

static

3

ecf55422e4...18.dll

windows7-x64

10

ecf55422e4...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    126s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    11-04-2024 08:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecf55422e419162d13d311df5560c939_JaffaCakes118.dll

  • Size

    1.0MB

  • MD5

    ecf55422e419162d13d311df5560c939

  • SHA1

    d198da34c100d5ac19b9989e04f2196c25b8588d

  • SHA256

    75779a5a395a747bafd0004877b7da03b8a98a8183debd69efcfe9fc383c5aa8

  • SHA512

    9b14460ea72def9c049b9b24464c3bf9723f31cc4985d30e551750d3078001e51288a0e304999c7268126546d0ad29453d3d5d316516b8447ac17e46e5cb0aa2

  • SSDEEP

    12288:9fHnu1hxBOwTdG7MDsDbQg779SweGIvdZOyjGU+G0VCspXMl3A6Gnzq9PBa8nT7:pHK3OwTd8MQDbQgHgUIv1jGUXuCs9qb

Score
10/10
bazarloaderdropperloader

Malware Config

Extracted

Family

bazarloader

C2

104.248.170.50

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 4 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ecf55422e419162d13d311df5560c939_JaffaCakes118.dll
    1⤵
      PID:2496
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecf55422e419162d13d311df5560c939_JaffaCakes118.dll,DllRegisterServer {F798AFE7-118A-4581-8E3E-E892DC5D6B28}
      1⤵
        PID:1708

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1708-1-0x0000000000280000-0x00000000002A7000-memory.dmp
        Filesize

        156KB

        Download
      • memory/1708-2-0x0000000000280000-0x00000000002A7000-memory.dmp
        Filesize

        156KB

        Download
      • memory/2496-0-0x00000000001B0000-0x00000000001D7000-memory.dmp
        Filesize

        156KB

        Download
      • memory/2496-3-0x00000000001B0000-0x00000000001D7000-memory.dmp
        Filesize

        156KB

        Download