Overview

overview

10

Static

static

3

ecf55422e4...18.dll

windows7-x64

10

ecf55422e4...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 08:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecf55422e419162d13d311df5560c939_JaffaCakes118.dll

  • Size

    1.0MB

  • MD5

    ecf55422e419162d13d311df5560c939

  • SHA1

    d198da34c100d5ac19b9989e04f2196c25b8588d

  • SHA256

    75779a5a395a747bafd0004877b7da03b8a98a8183debd69efcfe9fc383c5aa8

  • SHA512

    9b14460ea72def9c049b9b24464c3bf9723f31cc4985d30e551750d3078001e51288a0e304999c7268126546d0ad29453d3d5d316516b8447ac17e46e5cb0aa2

  • SSDEEP

    12288:9fHnu1hxBOwTdG7MDsDbQg779SweGIvdZOyjGU+G0VCspXMl3A6Gnzq9PBa8nT7:pHK3OwTd8MQDbQgHgUIv1jGUXuCs9qb

Score
10/10
bazarloaderdropperloader

Malware Config

Extracted

Family

bazarloader

C2

104.248.170.50

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 4 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ecf55422e419162d13d311df5560c939_JaffaCakes118.dll
    1⤵
      PID:2092
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecf55422e419162d13d311df5560c939_JaffaCakes118.dll,DllRegisterServer {12CDE37C-5553-475B-B050-BA5223A6030F}
      1⤵
        PID:4396

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2092-0-0x0000000002940000-0x0000000002967000-memory.dmp
        Filesize

        156KB

        Download
      • memory/2092-3-0x0000000002940000-0x0000000002967000-memory.dmp
        Filesize

        156KB

        Download
      • memory/4396-1-0x00000217205E0000-0x0000021720607000-memory.dmp
        Filesize

        156KB

        Download
      • memory/4396-2-0x00000217205E0000-0x0000021720607000-memory.dmp
        Filesize

        156KB

        Download