3c4e278e34855819d71854f04f4141075bb706d2592d979d3393f81bd5c5244d

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
Size

66KB
MD5

18201ab8fea5b6355f397e0f735fa830
SHA1

048e248dcfbec2ad904917b9b55fe1376b09de8b
SHA256

3c4e278e34855819d71854f04f4141075bb706d2592d979d3393f81bd5c5244d
SHA512

b3438579f16b6e57e1704dbb117aec0a91cdd9e4c1eda7feda4be2f47896009fa4b465f56cfdb897f188106923fb826c5a429ab356984872f6a75bea39f38b24
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXih:IeklMMYJhqezw/pXzH9ih

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2288-52-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2888	explorer.exe
2540	spoolsv.exe
2288	svchost.exe
2492	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
2888	explorer.exe
2888	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2288	svchost.exe
2288	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
2888	explorer.exe
2888	explorer.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2288	svchost.exe
2888	explorer.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe
2288	svchost.exe
2888	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2888	explorer.exe
2288	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
2888	explorer.exe
2888	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2288	svchost.exe
2288	svchost.exe
2492	spoolsv.exe
2492	spoolsv.exe
2888	explorer.exe
2888	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2888	1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe	28
PID 1976 wrote to memory of 2888	1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe	28
PID 1976 wrote to memory of 2888	1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe	28
PID 1976 wrote to memory of 2888	1976	18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 2540	2888	explorer.exe	29
PID 2888 wrote to memory of 2540	2888	explorer.exe	29
PID 2888 wrote to memory of 2540	2888	explorer.exe	29
PID 2888 wrote to memory of 2540	2888	explorer.exe	29
PID 2540 wrote to memory of 2288	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2288	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2288	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2288	2540	spoolsv.exe	30
PID 2288 wrote to memory of 2492	2288	svchost.exe	31
PID 2288 wrote to memory of 2492	2288	svchost.exe	31
PID 2288 wrote to memory of 2492	2288	svchost.exe	31
PID 2288 wrote to memory of 2492	2288	svchost.exe	31
PID 2288 wrote to memory of 1564	2288	svchost.exe	32
PID 2288 wrote to memory of 1564	2288	svchost.exe	32
PID 2288 wrote to memory of 1564	2288	svchost.exe	32
PID 2288 wrote to memory of 1564	2288	svchost.exe	32
PID 2288 wrote to memory of 2644	2288	svchost.exe	36
PID 2288 wrote to memory of 2644	2288	svchost.exe	36
PID 2288 wrote to memory of 2644	2288	svchost.exe	36
PID 2288 wrote to memory of 2644	2288	svchost.exe	36
PID 2288 wrote to memory of 2932	2288	svchost.exe	38
PID 2288 wrote to memory of 2932	2288	svchost.exe	38
PID 2288 wrote to memory of 2932	2288	svchost.exe	38
PID 2288 wrote to memory of 2932	2288	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18201ab8fea5b6355f397e0f735fa830_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2644
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
8d537168016b5faa2c6255adf2e4144c

SHA1
f697cc73ddfcdd12f03b801d81f4780fa2f01dc5

SHA256
c8dd57e104fc816262dfaaf52c3c212e26a80e6b23fcb1bd16af4b93467a30b8

SHA512
35db0381f50935a77401c9d581460d68789fc6e358f87bf17e360b09135ee2f0eb5ab54ff05e276e9bc3033402187287df963a76960fc9a089407d857ae70270

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
02b267e70ef6aff2a60b2f15fe2292a9

SHA1
c7eea746ed40076ecef2b214de10c59b3737bb32

SHA256
c2049f8e0255badc5c25d4d57fec868bc46dc0ec8a0233545e0b7719046a8954

SHA512
37a002c7d118620d91e726f05d4681998796a9bacca7dd3f935632d1831dd26b22be3eeae61c2b1bb8abbebf2f8f87e0b759792a8162dd3fcbf9883b0264b9ee

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
7a3a41c9edd79690c551618c80ff90f5

SHA1
bb93d9fb6255b6961adde426fac7bb49cdf1a7af

SHA256
c7c2896255ad4446ee3d73041877f98e9f16b324b88d1b089160814d8744a46c

SHA512
bdecd178cd198691873f705562f01bb289d85e6877a39bcf075336507aa362104584e52b387dfd5c64c7aa24287b612694284eaf961b77879e250a9c28014b64

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
b6ee81051ff8f481fe140dc5132ee25e

SHA1
fb9e98a7364f87ee72f033f8473d9a352f77d3e8

SHA256
217b3a7dd7def74f9fae92d4fffe0267ade35e7b516a3d5b5be11b1976aa566a

SHA512
7b3047f7e7ef941746ca67d446bf9c48b85fe36acf18a06138fe9ed9a0f2fd68f739ffcca490c2b300dc0d34d817d4d7bff6e3b58afade332d54441e7099f59f

Download Submit
memory/1976-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1976-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1976-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1976-65-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1976-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1976-60-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1976-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1976-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1976-17-0x00000000024B0000-0x00000000024E1000-memory.dmp

Filesize
196KB

Download
memory/1976-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2288-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2288-52-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2288-67-0x0000000002480000-0x00000000024B1000-memory.dmp

Filesize
196KB

Download
memory/2288-66-0x0000000002480000-0x00000000024B1000-memory.dmp

Filesize
196KB

Download
memory/2288-86-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2288-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2492-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2492-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-57-0x00000000006B0000-0x00000000006E1000-memory.dmp

Filesize
196KB

Download
memory/2540-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-35-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2888-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2888-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2888-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2888-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2888-95-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2888-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download