0aae33ce54246b6439d6f09ebd0c9d11493f3f548ccd0b29c65089007c4f5e71

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
Size

66KB
MD5

adecfb5b8996d248a5e1e07696bc6480
SHA1

baf4cf9a429bf3e66c4358313da5b125eea0a768
SHA256

0aae33ce54246b6439d6f09ebd0c9d11493f3f548ccd0b29c65089007c4f5e71
SHA512

37048e8dd49984beb461994fdcee8c991b54862a8b201d346b8a88313f81cca57cdc16614e7a6438d220ff6609f5e38caae2ea0df6f0207cd997b64b9a456398
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiW:IeklMMYJhqezw/pXzH9iW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2768-52-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2672	explorer.exe
2700	spoolsv.exe
2768	svchost.exe
2604	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
2672	explorer.exe
2672	explorer.exe
2700	spoolsv.exe
2700	spoolsv.exe
2768	svchost.exe
2768	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
2672	explorer.exe
2672	explorer.exe
2672	explorer.exe
2672	explorer.exe
2768	svchost.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe
2768	svchost.exe
2672	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2672	explorer.exe
2768	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
2672	explorer.exe
2672	explorer.exe
2700	spoolsv.exe
2700	spoolsv.exe
2768	svchost.exe
2768	svchost.exe
2604	spoolsv.exe
2604	spoolsv.exe
2672	explorer.exe
2672	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2672	2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	28
PID 2216 wrote to memory of 2672	2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	28
PID 2216 wrote to memory of 2672	2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	28
PID 2216 wrote to memory of 2672	2216	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	28
PID 2672 wrote to memory of 2700	2672	explorer.exe	29
PID 2672 wrote to memory of 2700	2672	explorer.exe	29
PID 2672 wrote to memory of 2700	2672	explorer.exe	29
PID 2672 wrote to memory of 2700	2672	explorer.exe	29
PID 2700 wrote to memory of 2768	2700	spoolsv.exe	30
PID 2700 wrote to memory of 2768	2700	spoolsv.exe	30
PID 2700 wrote to memory of 2768	2700	spoolsv.exe	30
PID 2700 wrote to memory of 2768	2700	spoolsv.exe	30
PID 2768 wrote to memory of 2604	2768	svchost.exe	31
PID 2768 wrote to memory of 2604	2768	svchost.exe	31
PID 2768 wrote to memory of 2604	2768	svchost.exe	31
PID 2768 wrote to memory of 2604	2768	svchost.exe	31
PID 2768 wrote to memory of 2316	2768	svchost.exe	32
PID 2768 wrote to memory of 2316	2768	svchost.exe	32
PID 2768 wrote to memory of 2316	2768	svchost.exe	32
PID 2768 wrote to memory of 2316	2768	svchost.exe	32
PID 2768 wrote to memory of 2676	2768	svchost.exe	36
PID 2768 wrote to memory of 2676	2768	svchost.exe	36
PID 2768 wrote to memory of 2676	2768	svchost.exe	36
PID 2768 wrote to memory of 2676	2768	svchost.exe	36
PID 2768 wrote to memory of 2124	2768	svchost.exe	38
PID 2768 wrote to memory of 2124	2768	svchost.exe	38
PID 2768 wrote to memory of 2124	2768	svchost.exe	38
PID 2768 wrote to memory of 2124	2768	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
    - - C:\Windows\SysWOW64\at.exe
        
        at 08:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2316
    - - C:\Windows\SysWOW64\at.exe
        
        at 08:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2676
    - - C:\Windows\SysWOW64\at.exe
        
        at 08:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
ba244f1a500cca2b61f61669604445ee

SHA1
8fa146431209fdab0a529f524b7046c5c0fdf7e4

SHA256
4c720bcd8b42de222be86604ec5526026702ada9eb22e14cdb180e0acb7cd6e6

SHA512
928b438c691289b802e3238a53a04886ecde3a822c3c917a3f33b9eb47c230518f2695a098ce04869601e67083db70f2d59464505dd7750a954f259530bf25ba

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
ddc8c5dfadbd227cef7222ade46ef48b

SHA1
6b2c7bd459a8c8967730ada54ebbee13de5bdc01

SHA256
ef1e32d8c7771929c8b58148d1c78b0f20ea383f90c6130236cb984d8ec25cae

SHA512
d09b41ed99e57dc8b74d95a6975603b7ca4912e33d498e02a4b0e725be5e4f619541917a50d476160d85194f778129407847d7e7fa06010be25e2fe50baf4d77

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
cfdfe9cddea80cb359d34e6b8a319d32

SHA1
82f71bfcd96227812ab44249db75c125a113f1b5

SHA256
6001491a9e1480e717758a2efade95a73246c9b4ee02ea8c4f4ee10eff1547fd

SHA512
41a74de18de42c527800ef8387d1976221e0e43fac61940aa633ab5aaa6d6fd7c2dc4ccb116ee35a10ba83ecd06e621b5123d8e02b7c68295595e7a8a12fdb65

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
e81004e4d5a8915e7ba6aef2938420d1

SHA1
e9227ebf63a29c868bb4c1b9254538fbda7e3c6d

SHA256
a0a11ea4bbaf6696f097558b1bbff40b6e9fc12d20e106da7508bad5551e7b68

SHA512
32da8c8128252e0b5539b9e1b55880ccfc442ab5d87db7d98293c3c2b70c883a339af8711c48ca8eae67ddda726e7bb84fd90ff440fc90899d9e8b6ee2386720

Download Submit
memory/2216-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2216-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2216-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2216-17-0x0000000003290000-0x00000000032C1000-memory.dmp

Filesize
196KB

Download
memory/2216-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2216-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2216-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2216-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2216-63-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2604-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2604-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2604-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-35-0x0000000002550000-0x0000000002581000-memory.dmp

Filesize
196KB

Download
memory/2672-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2672-91-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-29-0x0000000002550000-0x0000000002581000-memory.dmp

Filesize
196KB

Download
memory/2700-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2700-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2700-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2768-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2768-64-0x0000000000850000-0x0000000000881000-memory.dmp

Filesize
196KB

Download
memory/2768-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2768-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2768-52-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download