d2febd149b9558dacf694e6c1a8e3d06bf05bd4d848a7a13083a429cd2b78543

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e48282011b4d855bcd15b6a938726270_NEIKI.exe
Size

66KB
MD5

e48282011b4d855bcd15b6a938726270
SHA1

1772c8bfee0be0a4b8b86df0a215ff0d429ec2af
SHA256

d2febd149b9558dacf694e6c1a8e3d06bf05bd4d848a7a13083a429cd2b78543
SHA512

5ba1331939911ea157667cf5b5a5815eb6d6a1ee175fc50c095785c0b6f9008a2929488554c865406f496e2bd11330bb38969cc7ff70c33d312ab268d3f91436
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXik:IeklMMYJhqezw/pXzH9ik

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2560-55-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2532	explorer.exe
2240	spoolsv.exe
2560	svchost.exe
320	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
996	e48282011b4d855bcd15b6a938726270_NEIKI.exe
996	e48282011b4d855bcd15b6a938726270_NEIKI.exe
2532	explorer.exe
2532	explorer.exe
2240	spoolsv.exe
2240	spoolsv.exe
2560	svchost.exe
2560	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	e48282011b4d855bcd15b6a938726270_NEIKI.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
996	e48282011b4d855bcd15b6a938726270_NEIKI.exe
2532	explorer.exe
2532	explorer.exe
2532	explorer.exe
2532	explorer.exe
2560	svchost.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe
2560	svchost.exe
2532	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2532	explorer.exe
2560	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
996	e48282011b4d855bcd15b6a938726270_NEIKI.exe
996	e48282011b4d855bcd15b6a938726270_NEIKI.exe
2532	explorer.exe
2532	explorer.exe
2240	spoolsv.exe
2240	spoolsv.exe
2560	svchost.exe
2560	svchost.exe
320	spoolsv.exe
320	spoolsv.exe
2532	explorer.exe
2532	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2532	996	e48282011b4d855bcd15b6a938726270_NEIKI.exe	28
PID 996 wrote to memory of 2532	996	e48282011b4d855bcd15b6a938726270_NEIKI.exe	28
PID 996 wrote to memory of 2532	996	e48282011b4d855bcd15b6a938726270_NEIKI.exe	28
PID 996 wrote to memory of 2532	996	e48282011b4d855bcd15b6a938726270_NEIKI.exe	28
PID 2532 wrote to memory of 2240	2532	explorer.exe	29
PID 2532 wrote to memory of 2240	2532	explorer.exe	29
PID 2532 wrote to memory of 2240	2532	explorer.exe	29
PID 2532 wrote to memory of 2240	2532	explorer.exe	29
PID 2240 wrote to memory of 2560	2240	spoolsv.exe	30
PID 2240 wrote to memory of 2560	2240	spoolsv.exe	30
PID 2240 wrote to memory of 2560	2240	spoolsv.exe	30
PID 2240 wrote to memory of 2560	2240	spoolsv.exe	30
PID 2560 wrote to memory of 320	2560	svchost.exe	31
PID 2560 wrote to memory of 320	2560	svchost.exe	31
PID 2560 wrote to memory of 320	2560	svchost.exe	31
PID 2560 wrote to memory of 320	2560	svchost.exe	31
PID 2560 wrote to memory of 2768	2560	svchost.exe	32
PID 2560 wrote to memory of 2768	2560	svchost.exe	32
PID 2560 wrote to memory of 2768	2560	svchost.exe	32
PID 2560 wrote to memory of 2768	2560	svchost.exe	32
PID 2560 wrote to memory of 1276	2560	svchost.exe	36
PID 2560 wrote to memory of 1276	2560	svchost.exe	36
PID 2560 wrote to memory of 1276	2560	svchost.exe	36
PID 2560 wrote to memory of 1276	2560	svchost.exe	36
PID 2560 wrote to memory of 2896	2560	svchost.exe	38
PID 2560 wrote to memory of 2896	2560	svchost.exe	38
PID 2560 wrote to memory of 2896	2560	svchost.exe	38
PID 2560 wrote to memory of 2896	2560	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\e48282011b4d855bcd15b6a938726270_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\e48282011b4d855bcd15b6a938726270_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2768
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1276
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
3bf5f9f6ac2485652a1ae7cff195e825

SHA1
4385982fb8527f78ba4f7a061c844e0c5f310b08

SHA256
af3a4163aa565587e8ad9349db85aac7c8201f4ed2a42e7b34917208dc6594e5

SHA512
e735fe5152e5cd721e08e6dca3c49214dfa3a2a49183d81763293bf2bb450938e64f0a549824bab19a146347634ce68e2f0a763fdeff4e94b9a256950393b1f1

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
73b17774cafa062acfe77ae4330bee3d

SHA1
c686b55efddc65b1de62521a4f34e842420fd41a

SHA256
252c12929328e959cff3227d61abedefb6261677467b47e14c038f521219dc5f

SHA512
b84e95d228673e9c28e27ad47eb38fbf96d1820120f8209c4f11db8f5ee825a9a628810b3f7185beb66edb0f25e802d5c2d8286f3d311726b1cc45c16041f1ce

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
0a15be927409f49201c37a4a5166d5a8

SHA1
ebd79e0e3d1d43ea329291ff35b33573784cdc94

SHA256
b0def7d1b6edba57c7dc294bb2ab4fe71553aa65124f2b2799733d6af5658ef3

SHA512
08ab234099799c48024295a160842f19477fb013cf80abfb73d84a1017e2633d16673c3c43c9181a1d3855502f57846d8cd6a3547ad629c2fe5d5036559d73f0

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
90e69b67fec651ec544e379fe8186b5c

SHA1
f4009a75c3c623b00fd18414b94cbf09f9cfad6c

SHA256
87f64e55026a5cd5aaeb48ab28a061002745a4c407f9fb8e056fc8a5e926fdca

SHA512
0988870137f96212e77ee8b725da6f292e2b7f53426bf8faee33c961799a7e45014928b114cb600009730cced588643be3201f234f02641ce2f3c5e0a64ec7b9

Download Submit
memory/320-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/320-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/996-16-0x0000000002880000-0x00000000028B1000-memory.dmp

Filesize
196KB

Download
memory/996-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/996-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/996-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/996-17-0x0000000002880000-0x00000000028B1000-memory.dmp

Filesize
196KB

Download
memory/996-63-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/996-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/996-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/996-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/996-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2240-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2240-53-0x0000000001D60000-0x0000000001D91000-memory.dmp

Filesize
196KB

Download
memory/2240-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2240-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2240-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2532-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2560-65-0x0000000002750000-0x0000000002781000-memory.dmp

Filesize
196KB

Download
memory/2560-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2560-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2560-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2560-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download