Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 06:53

General

  • Target

    a33ace223221f156ad2565feb80d1d80_NeikiAnalytics.exe

  • Size

    65KB

  • MD5

    a33ace223221f156ad2565feb80d1d80

  • SHA1

    e5ff85d983065d07a0241d6f20587dee9bb65ac1

  • SHA256

    9abeaa49787d3100f775be46625ac686cf690f06027a52f1ec9951e00705ac7f

  • SHA512

    f392f4787c995fcc8f231b0e90869c4792b28b35c99e95b5d468f806826749eec8e8580a3c3a215500b62b663920a0af91f53532c02114e029661f1bca0c9be1

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouk:7WNqkOJWmo1HpM0MkTUmuk

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a33ace223221f156ad2565feb80d1d80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a33ace223221f156ad2565feb80d1d80_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3304
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3160
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:404
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3224
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:224
          • C:\Windows\SysWOW64\at.exe
            at 06:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2904
            • C:\Windows\SysWOW64\at.exe
              at 06:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3616
              • C:\Windows\SysWOW64\at.exe
                at 06:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1540
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4352

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Roaming\mrsys.exe

                  Filesize

                  65KB

                  MD5

                  834ea6c818813aa4e2906225f0bc0759

                  SHA1

                  9d518a9cfc7a48bf2f963172c9ba5c474056d831

                  SHA256

                  9bbf0b2fe9062c2e87d32d0b6656d343bee762f7c647466fac22508f2f2b913d

                  SHA512

                  07803daa326387abf744c923c3305fdcb10e3fbed3dfb8202eaa6b56fced4c25042ef84a289dc389a2ab60c9bea4ba14019b7d7f0236d911b98fc259035b5ee0

                • C:\Windows\System\explorer.exe

                  Filesize

                  65KB

                  MD5

                  d88dedabef80f93b72733aebb33257a5

                  SHA1

                  cbb5821a110b0d4c2bf2d235abf5587416ebcf4e

                  SHA256

                  40a436179a20182d86bf6b838c32ff8103cb7fa836efc4c94b756a5a96ec0e93

                  SHA512

                  ab9a1adc8ef43d3d1b6b3a1a5305abfc1e2d47f613be88d37c1789ddcbdece0bd84802cdb07f1a7731b91b3f2886023ff61d551bd9de244afd7cb7e7dde7a8d1

                • C:\Windows\System\spoolsv.exe

                  Filesize

                  65KB

                  MD5

                  f2dbcab1299e3370a634e6c117506436

                  SHA1

                  1cc7645a7b555fc06c315e62bc68e6ae10adda2b

                  SHA256

                  97317a3912540b08a514bfcffee32298baa1353104e2639895a5ab265503edc8

                  SHA512

                  7bc51d667dc0c41bdd1e18761a923b1520767d34db25c1d0d10d23ec3767640512c046ddd190f8b5eb54028fcd0221a42711b460ba91657bc0ff4314ad54e49b

                • C:\Windows\System\svchost.exe

                  Filesize

                  65KB

                  MD5

                  ce9591e76e0bbd7402225ff948e32163

                  SHA1

                  871f7566dfe2829ebc5ba9416d307226c671fa71

                  SHA256

                  6ccaaa80e11f53a4476fac912e9ef41e90e25eb7468689277da4994feb3e9864

                  SHA512

                  2a8fee7926dddf78c00c71d7949f8e6178e4ff1fe1ea26ef2baa873e954b5d8371d6d7676fbc4b500fb22982134fc33b3c61ef46f6fb16e10f5fb380078ce5c4

                • memory/224-49-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/224-44-0x0000000074C80000-0x0000000074DDD000-memory.dmp

                  Filesize

                  1.4MB

                • memory/404-53-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/404-25-0x0000000074C80000-0x0000000074DDD000-memory.dmp

                  Filesize

                  1.4MB

                • memory/3160-13-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3160-16-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3160-14-0x0000000074C80000-0x0000000074DDD000-memory.dmp

                  Filesize

                  1.4MB

                • memory/3160-71-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3160-58-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3224-60-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3224-41-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3224-36-0x0000000074C80000-0x0000000074DDD000-memory.dmp

                  Filesize

                  1.4MB

                • memory/3304-4-0x0000000000401000-0x000000000042E000-memory.dmp

                  Filesize

                  180KB

                • memory/3304-2-0x0000000074C80000-0x0000000074DDD000-memory.dmp

                  Filesize

                  1.4MB

                • memory/3304-3-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3304-55-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                • memory/3304-56-0x0000000000401000-0x000000000042E000-memory.dmp

                  Filesize

                  180KB

                • memory/3304-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

                  Filesize

                  16KB

                • memory/3304-39-0x0000000000401000-0x000000000042E000-memory.dmp

                  Filesize

                  180KB

                • memory/3304-35-0x00000000001C0000-0x00000000001C4000-memory.dmp

                  Filesize

                  16KB

                • memory/3304-0-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB