Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 06:53

General

  • Target

    a33ace223221f156ad2565feb80d1d80_NeikiAnalytics.exe

  • Size

    65KB

  • MD5

    a33ace223221f156ad2565feb80d1d80

  • SHA1

    e5ff85d983065d07a0241d6f20587dee9bb65ac1

  • SHA256

    9abeaa49787d3100f775be46625ac686cf690f06027a52f1ec9951e00705ac7f

  • SHA512

    f392f4787c995fcc8f231b0e90869c4792b28b35c99e95b5d468f806826749eec8e8580a3c3a215500b62b663920a0af91f53532c02114e029661f1bca0c9be1

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouk:7WNqkOJWmo1HpM0MkTUmuk

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a33ace223221f156ad2565feb80d1d80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a33ace223221f156ad2565feb80d1d80_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2104
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2424
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2592
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2672
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2496
          • C:\Windows\SysWOW64\at.exe
            at 06:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2828
            • C:\Windows\SysWOW64\at.exe
              at 06:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1436
              • C:\Windows\SysWOW64\at.exe
                at 06:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1776

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                65KB

                MD5

                51fa753a71e94a9272ab8abd28a7657b

                SHA1

                4998cf7fe2a215f85b9a75d5c32ecf1983757b9f

                SHA256

                b9c4e1f45e42934c2a24374e3292934783b8fe974c85e5bf13cc01225ce45fb6

                SHA512

                667809453f9d77fa8b717a9a9d7fa19ccddfead546525e2a3b3ceb63d6d7d6391c1a1062e441af7afb5822b83c623b1307c5a1ab181ddb93b1fb34ccce75db96

              • C:\Windows\system\explorer.exe

                Filesize

                65KB

                MD5

                e128346b219ecc9d6bb633b5097eb32e

                SHA1

                80e89a26f38c4bc6b3469e3c5ea80d3780435540

                SHA256

                1915cd69993fb2ecef91eaea11aae73ade95ac1aa674505a43800052bd9efb04

                SHA512

                b50132db1923e446cbe110b03442c73ad2b75a3012cc06a4788211b4443fcbe556b05204b83e9db8885eed14ff630f5bc5191bc0e4b7257ec512ff48c7c9e909

              • C:\Windows\system\svchost.exe

                Filesize

                65KB

                MD5

                65895be4905dcd58a6ac1dafad47ac7b

                SHA1

                24a7fff91afb8ee5d9fe1017e67e6e698ea7b5d1

                SHA256

                ceccb348eb3b8d81fc7b5b801bd773e26e049e2ceac71fcfe016a5c696300cde

                SHA512

                818c93ffa362453fc7bd9f3ca552c9e2431fdd49bc03df3ab1ae9409307594e132281e21a9d385db85bbfefd6b521c8f517e83bd1462e52cf96a4757c99a456c

              • \Windows\system\spoolsv.exe

                Filesize

                65KB

                MD5

                2bdf460df895992bd5c245623fb11bde

                SHA1

                5f407c3fb0f3873aa05fcf8f8e09d7d2864dca25

                SHA256

                4a1ae360f521c5ab1364bb4acbe124ce3fac4a277438ac54f79a11d9e6863fcd

                SHA512

                e6783c5ff31bbe3cd627841aac20b8eb9f66e63c22bd510e784ac79ac0690836b297e09431382216cb5f3fa403dcbc08300f3d81315c59cbc871ef40d6c728f3

              • memory/2104-65-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/2104-4-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/2104-18-0x0000000001D40000-0x0000000001D71000-memory.dmp

                Filesize

                196KB

              • memory/2104-17-0x0000000001D40000-0x0000000001D71000-memory.dmp

                Filesize

                196KB

              • memory/2104-0-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2104-2-0x0000000000020000-0x0000000000024000-memory.dmp

                Filesize

                16KB

              • memory/2104-83-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/2104-3-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2104-82-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2104-1-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2424-20-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2424-85-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2424-95-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2424-19-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2424-36-0x0000000002840000-0x0000000002871000-memory.dmp

                Filesize

                196KB

              • memory/2424-24-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2424-69-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2496-76-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2496-70-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2592-55-0x0000000002F00000-0x0000000002F31000-memory.dmp

                Filesize

                196KB

              • memory/2592-80-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2592-37-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2592-38-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2592-43-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2592-54-0x0000000002F00000-0x0000000002F31000-memory.dmp

                Filesize

                196KB

              • memory/2672-66-0x0000000002640000-0x0000000002671000-memory.dmp

                Filesize

                196KB

              • memory/2672-67-0x0000000002640000-0x0000000002671000-memory.dmp

                Filesize

                196KB

              • memory/2672-60-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2672-56-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2672-86-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB