BazarLoader: password-protected zip to Cobalt Strike

BazarLoader spreads through email and exists mostly to prepare the ground for something bigger, typically Cobalt Strike and then ransomware.

Chain

malspam
  -> password-protected zip (password in the mail body)
       -> Word document, macros enabled by the user
            -> drops an HTA
                 -> HTA contains an obfuscated URL
                      -> downloads the BazarLoader DLL
                           -> DLL beacons to its server
                                -> Cobalt Strike delivered

Details from the sample

• The document comes inside a zip; the message text gives the password, which keeps mail scanners from inspecting the attachment.
• The macro writes an HTA that decodes a long URL and retrieves the DLL.
• The DLL is saved with an image name, videoinstall.jpg, in the Public users folder, and run with regsvr32.
• After running, it contacts a bare IP address for the next stage, which is Cobalt Strike.

winword.exe
 `- mshta.exe  (HTA from the macro)
      `- regsvr32.exe  C:\users\public\videoinstall.jpg
           `- outbound HTTP to the stage-two server

Why look at it

BazarLoader was one of the loaders that later gave way to Bumblebee. Recognising the Word-HTA-DLL pattern and the odd file extension on a DLL helps connect old and new activity.