0aae33ce54246b6439d6f09ebd0c9d11493f3f548ccd0b29c65089007c4f5e71

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
Size

66KB
MD5

adecfb5b8996d248a5e1e07696bc6480
SHA1

baf4cf9a429bf3e66c4358313da5b125eea0a768
SHA256

0aae33ce54246b6439d6f09ebd0c9d11493f3f548ccd0b29c65089007c4f5e71
SHA512

37048e8dd49984beb461994fdcee8c991b54862a8b201d346b8a88313f81cca57cdc16614e7a6438d220ff6609f5e38caae2ea0df6f0207cd997b64b9a456398
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiW:IeklMMYJhqezw/pXzH9iW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/4744-37-0x0000000074C90000-0x0000000074DED000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
1428	explorer.exe
1472	spoolsv.exe
4744	svchost.exe
3228	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
1428	explorer.exe
1428	explorer.exe
1428	explorer.exe
1428	explorer.exe
1428	explorer.exe
1428	explorer.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe
4744	svchost.exe
4744	svchost.exe
1428	explorer.exe
1428	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1428	explorer.exe
4744	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
1428	explorer.exe
1428	explorer.exe
1472	spoolsv.exe
1472	spoolsv.exe
4744	svchost.exe
4744	svchost.exe
3228	spoolsv.exe
3228	spoolsv.exe
1428	explorer.exe
1428	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1428	340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	83
PID 340 wrote to memory of 1428	340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	83
PID 340 wrote to memory of 1428	340	adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe	83
PID 1428 wrote to memory of 1472	1428	explorer.exe	84
PID 1428 wrote to memory of 1472	1428	explorer.exe	84
PID 1428 wrote to memory of 1472	1428	explorer.exe	84
PID 1472 wrote to memory of 4744	1472	spoolsv.exe	86
PID 1472 wrote to memory of 4744	1472	spoolsv.exe	86
PID 1472 wrote to memory of 4744	1472	spoolsv.exe	86
PID 4744 wrote to memory of 3228	4744	svchost.exe	87
PID 4744 wrote to memory of 3228	4744	svchost.exe	87
PID 4744 wrote to memory of 3228	4744	svchost.exe	87
PID 4744 wrote to memory of 3796	4744	svchost.exe	89
PID 4744 wrote to memory of 3796	4744	svchost.exe	89
PID 4744 wrote to memory of 3796	4744	svchost.exe	89
PID 4744 wrote to memory of 4556	4744	svchost.exe	103
PID 4744 wrote to memory of 4556	4744	svchost.exe	103
PID 4744 wrote to memory of 4556	4744	svchost.exe	103
PID 4744 wrote to memory of 1260	4744	svchost.exe	112
PID 4744 wrote to memory of 1260	4744	svchost.exe	112
PID 4744 wrote to memory of 1260	4744	svchost.exe	112

C:\Users\Admin\AppData\Local\Temp\adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\adecfb5b8996d248a5e1e07696bc6480_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1428
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - C:\Windows\SysWOW64\at.exe
        
        at 08:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\at.exe
        
        at 08:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4556
    - - C:\Windows\SysWOW64\at.exe
        
        at 08:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
84e801fccca4b3c78e4d5a027ae85fb5

SHA1
bfff065231745011d25cdf884737b5bea1c91669

SHA256
ead946e4b1e95ab0fde6b3400d04bc984a743d9f8e592c83940d90e3cee772e0

SHA512
729bc46fa8ab3d312d8604524081a70fb55ae7daf6aded00cf0585707450bb702bf0fd51d488fba94943ef70d0f846153268aba77add2d7acc4090949769c66c

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
558102a34be69a29fc5d8fb49eb1a327

SHA1
367a495fdfaec1a0eb6dcf07bfc6a3ebd80bcf63

SHA256
be7944e5743122f0d18c87b73f0d395e55c6f44b20ca366d2d3ceb2e86b0c7e8

SHA512
d7f0dc5e90f0fb3a2a93ffee1d2f120e74ba3bafd4beab9da6d115b85cf920452410edb31e8656060fd2a14f0b0257241f67cd4e0f0c762f428d9374ed2c2700

Download Submit
C:\Windows\System\svchost.exe

Filesize
66KB

MD5
571359b6bcd68faa07fbf42be9dd9f43

SHA1
d67a56ae3cba98e8b5ce378f57d86774cebbfd7c

SHA256
b02555ad4627a0d0a74a69004d380adafb34a7e2464665186b730783a0fd04bb

SHA512
032e688ee03a74b11f80fa61051748e6f40678848b858815a2f5d71abee0631c743ec1f2d01dd77c8d880511c6140ff26f40c19cda2845dff26391c6f73e6bc2

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
66KB

MD5
cee88e48782fdebae3bb10a746faa5ce

SHA1
3bdf8e8e2bba7d56ee8bd2915141672142b3d08d

SHA256
725384038424b70ee239d381237ad45f99fc2f0ad50bbd15a15b55f29ffa3dc4

SHA512
cd4b77291d1f3336754424fac125cef93e7ca058315498737ce688631e6e96fa51082e4148271085c01edfd20a707066cb81f2aeaaee2ae13da5deec999bee5f

Download Submit
memory/340-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/340-2-0x0000000074C90000-0x0000000074DED000-memory.dmp

Filesize
1.4MB

Download
memory/340-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/340-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/340-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/340-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/340-57-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1428-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-14-0x0000000074C90000-0x0000000074DED000-memory.dmp

Filesize
1.4MB

Download
memory/1428-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1472-29-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1472-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1472-26-0x0000000074C90000-0x0000000074DED000-memory.dmp

Filesize
1.4MB

Download
memory/1472-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3228-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3228-44-0x0000000074C90000-0x0000000074DED000-memory.dmp

Filesize
1.4MB

Download
memory/4744-37-0x0000000074C90000-0x0000000074DED000-memory.dmp

Filesize
1.4MB

Download
memory/4744-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4744-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download