77fb0809e2c9f40140a30339dbe85b64a6ad86de52f965fd077a8e4151b965ad

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d04d9c582590db215169327b3c95170_NEAS.exe
Size

65KB
MD5

7d04d9c582590db215169327b3c95170
SHA1

16131d62ef948938e0b8afb72d581c90eaaa8996
SHA256

77fb0809e2c9f40140a30339dbe85b64a6ad86de52f965fd077a8e4151b965ad
SHA512

2fccddb1c541d3883229d36ee283fe169725fda95b1222e6c9ad5ccb2af23407b8195b6fac402722eb75db08880a5255bdd275f2a3e2d88ec710990ae865e264
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuB:7WNqkOJWmo1HpM0MkTUmuB

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2704-56-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2788	explorer.exe
2504	spoolsv.exe
2704	svchost.exe
2616	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1664	7d04d9c582590db215169327b3c95170_NEAS.exe
1664	7d04d9c582590db215169327b3c95170_NEAS.exe
2788	explorer.exe
2788	explorer.exe
2504	spoolsv.exe
2504	spoolsv.exe
2704	svchost.exe
2704	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	7d04d9c582590db215169327b3c95170_NEAS.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1664	7d04d9c582590db215169327b3c95170_NEAS.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2704	svchost.exe
2788	explorer.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2788	explorer.exe
2704	svchost.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe
2704	svchost.exe
2788	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2788	explorer.exe
2704	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1664	7d04d9c582590db215169327b3c95170_NEAS.exe
1664	7d04d9c582590db215169327b3c95170_NEAS.exe
2788	explorer.exe
2788	explorer.exe
2504	spoolsv.exe
2504	spoolsv.exe
2704	svchost.exe
2704	svchost.exe
2616	spoolsv.exe
2616	spoolsv.exe
2788	explorer.exe
2788	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2788	1664	7d04d9c582590db215169327b3c95170_NEAS.exe	28
PID 1664 wrote to memory of 2788	1664	7d04d9c582590db215169327b3c95170_NEAS.exe	28
PID 1664 wrote to memory of 2788	1664	7d04d9c582590db215169327b3c95170_NEAS.exe	28
PID 1664 wrote to memory of 2788	1664	7d04d9c582590db215169327b3c95170_NEAS.exe	28
PID 2788 wrote to memory of 2504	2788	explorer.exe	29
PID 2788 wrote to memory of 2504	2788	explorer.exe	29
PID 2788 wrote to memory of 2504	2788	explorer.exe	29
PID 2788 wrote to memory of 2504	2788	explorer.exe	29
PID 2504 wrote to memory of 2704	2504	spoolsv.exe	30
PID 2504 wrote to memory of 2704	2504	spoolsv.exe	30
PID 2504 wrote to memory of 2704	2504	spoolsv.exe	30
PID 2504 wrote to memory of 2704	2504	spoolsv.exe	30
PID 2704 wrote to memory of 2616	2704	svchost.exe	31
PID 2704 wrote to memory of 2616	2704	svchost.exe	31
PID 2704 wrote to memory of 2616	2704	svchost.exe	31
PID 2704 wrote to memory of 2616	2704	svchost.exe	31
PID 2704 wrote to memory of 1492	2704	svchost.exe	32
PID 2704 wrote to memory of 1492	2704	svchost.exe	32
PID 2704 wrote to memory of 1492	2704	svchost.exe	32
PID 2704 wrote to memory of 1492	2704	svchost.exe	32
PID 2704 wrote to memory of 1776	2704	svchost.exe	36
PID 2704 wrote to memory of 1776	2704	svchost.exe	36
PID 2704 wrote to memory of 1776	2704	svchost.exe	36
PID 2704 wrote to memory of 1776	2704	svchost.exe	36
PID 2704 wrote to memory of 2148	2704	svchost.exe	38
PID 2704 wrote to memory of 2148	2704	svchost.exe	38
PID 2704 wrote to memory of 2148	2704	svchost.exe	38
PID 2704 wrote to memory of 2148	2704	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\7d04d9c582590db215169327b3c95170_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\7d04d9c582590db215169327b3c95170_NEAS.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1492
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1776
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
4fa6cbef1db77ab0c53e82870bb71247

SHA1
a96664ce79e250f1a3855455896becfad93ed3b8

SHA256
d0bf74235ae31e5067b742fe3fb54e037f54aea3af190969df0a9523edb837f0

SHA512
2813a3456915d41e0e72e1fec391b2f71df03589bb52fdbefc14b638c609203f11729da32331b3ab280cfcd410c2100ff9b47ccca4c0b34d6a1572e3f6496ca0

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
b3593cea490d0a60d01c7101feadedee

SHA1
240f9bb94203de961424ac7588d0c16acda8751f

SHA256
341f2f29f154e4b826a37b1ba8be625ad3974a9d2a383c560bc9a0ece123afdb

SHA512
e4bdec7956eb18af5a3de7516d1a9428b0b87aa401b2c90e87fd67f1f7af2e6584d26cc2183be6867ff8cf6b12f094c9966c4fe640c2fd52201fb44c4038c158

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
5d25b34d9dae18757baedb7a9549ded4

SHA1
ff02ab254b4b8ab159184d0b111ceb1f0d1c0db1

SHA256
39f2f7565cf281afd6e175bb783926e54ff69cc5ddebe55fb8c555032650d85a

SHA512
0104e2fd3c00a45551cddbac25553d9dd5e3ce81c9994617222ef4077b9fcec4e6af3bc9381dc27fa2e5221360089ee339fdd238b688050eb55956ffb87dde94

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
75a5e93b1c2aeec74ea617dbf2ab9675

SHA1
83f332a37e5052e58ef0ff484a2edfa5324dac10

SHA256
81b54f4e4b446f84f6a0ec85cf4d2e70299b1c6822b22e8abe6f82eec3f483b5

SHA512
aafeadd4ed5e22a22cff4694b3155deef2351aed33635316afc5e021ae52b0724eeaa52f19b50814b056dd99d24f40ddc7dd3c1d85b7a94408af58d220699730

Download Submit
memory/1664-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1664-47-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1664-15-0x00000000025B0000-0x00000000025E1000-memory.dmp

Filesize
196KB

Download
memory/1664-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1664-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1664-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1664-53-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1664-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1664-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1664-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2504-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2504-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2504-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2504-54-0x0000000002590000-0x00000000025C1000-memory.dmp

Filesize
196KB

Download
memory/2616-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-69-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2704-66-0x0000000001ED0000-0x0000000001F01000-memory.dmp

Filesize
196KB

Download
memory/2704-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2704-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2704-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2704-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2788-35-0x0000000002700000-0x0000000002731000-memory.dmp

Filesize
196KB

Download
memory/2788-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2788-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2788-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2788-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2788-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2788-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download