f7fda77d4d9a347e73cbc1461412cac9f7fcb0ab19a6fb3a238604d1307b9dcf

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
Size

66KB
MD5

aa517970dcecccf371649e1cb8b53af0
SHA1

824f1382e42c9a1a0337db8f24cfd7c836c92a25
SHA256

f7fda77d4d9a347e73cbc1461412cac9f7fcb0ab19a6fb3a238604d1307b9dcf
SHA512

682124d9bc8bd84fda67afd04a25c5e99c3b4150e1a8e5c5e90d6b8230545483970e50b7d36e08fc64360f42983dabcd2c16589073321e0eeaa51841db9ab3ee
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi8:IeklMMYJhqezw/pXzH9i8

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2936-57-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2564	explorer.exe
2668	spoolsv.exe
2936	svchost.exe
2532	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
2564	explorer.exe
2564	explorer.exe
2668	spoolsv.exe
2668	spoolsv.exe
2936	svchost.exe
2936	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2936	svchost.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe
2936	svchost.exe
2564	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2564	explorer.exe
2936	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
2564	explorer.exe
2564	explorer.exe
2668	spoolsv.exe
2668	spoolsv.exe
2936	svchost.exe
2936	svchost.exe
2532	spoolsv.exe
2532	spoolsv.exe
2564	explorer.exe
2564	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2564	1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe	28
PID 1904 wrote to memory of 2564	1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe	28
PID 1904 wrote to memory of 2564	1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe	28
PID 1904 wrote to memory of 2564	1904	aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe	28
PID 2564 wrote to memory of 2668	2564	explorer.exe	29
PID 2564 wrote to memory of 2668	2564	explorer.exe	29
PID 2564 wrote to memory of 2668	2564	explorer.exe	29
PID 2564 wrote to memory of 2668	2564	explorer.exe	29
PID 2668 wrote to memory of 2936	2668	spoolsv.exe	30
PID 2668 wrote to memory of 2936	2668	spoolsv.exe	30
PID 2668 wrote to memory of 2936	2668	spoolsv.exe	30
PID 2668 wrote to memory of 2936	2668	spoolsv.exe	30
PID 2936 wrote to memory of 2532	2936	svchost.exe	31
PID 2936 wrote to memory of 2532	2936	svchost.exe	31
PID 2936 wrote to memory of 2532	2936	svchost.exe	31
PID 2936 wrote to memory of 2532	2936	svchost.exe	31
PID 2936 wrote to memory of 844	2936	svchost.exe	32
PID 2936 wrote to memory of 844	2936	svchost.exe	32
PID 2936 wrote to memory of 844	2936	svchost.exe	32
PID 2936 wrote to memory of 844	2936	svchost.exe	32
PID 2936 wrote to memory of 2784	2936	svchost.exe	36
PID 2936 wrote to memory of 2784	2936	svchost.exe	36
PID 2936 wrote to memory of 2784	2936	svchost.exe	36
PID 2936 wrote to memory of 2784	2936	svchost.exe	36
PID 2936 wrote to memory of 3064	2936	svchost.exe	38
PID 2936 wrote to memory of 3064	2936	svchost.exe	38
PID 2936 wrote to memory of 3064	2936	svchost.exe	38
PID 2936 wrote to memory of 3064	2936	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aa517970dcecccf371649e1cb8b53af0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:844
    - - C:\Windows\SysWOW64\at.exe
        
        at 05:59 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2784
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:00 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
58f5d42f0c20e751a1ac6d7438bbd159

SHA1
0add6334d764cda18220dbf1413aad93a0d6e45d

SHA256
21f4b725ecfa6b78735cbca59753513f95c7615b6ce92545f468d8eed94d3b93

SHA512
1253f34cbfa2fd760ec451bc34c86a5cacb4c6912184f8aff39cfdd7db45e7f94d9b9511ed110fa5312f1550d2d8b0646dc589f0f8f92e502b9852fc6bd2daab

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
d668ea5237324509d842650161543ac7

SHA1
7a7249c56ce525f42eb7ddd1d70968dda4807b36

SHA256
b593f579314358ef11b8b8e35a1338b5916c6f12a62022ef8b54a04d80128afa

SHA512
886746d185bb5d0911a8696cfc5ca32a0963ef901e717855bcd40ec4e197346d8219d42c9340b09046f91e1d7484d5956211cb7f1e8ad6ad5793e45e5d1ededa

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
1fd45e1d96ad94b021d18ee1be25fee4

SHA1
00e10a8ddc3389f14a790b1a6a6eab4664b230c8

SHA256
2c013feb212ce18e558651ffb70a57b6b285387f8f696ee5fc6d4c3ace165f69

SHA512
482196cd27f14a21bb256459eb3f653d62f1ed622db22fd68b4659c724bb4bb07414faec86691804e050b8e3c102ce21180150ab5de7f2ce4e43409bf64f5e6c

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
f7309a423b9894cdd41319ea5b071991

SHA1
32df3f0a079ba2cdbbd7ec0be097db0c31c19899

SHA256
5d3d56b24ed556ff8255c237161469986cd80c2c2551ffdb8570af573fdb7557

SHA512
5c5036148b0999ffbf317cfaa3015b52f9e84c509a7f7b215ae5a4db7a5c7d8934ee3bdfb39c1732c1db1ab7deda06d0fe2113a536375f4e0f97368d328f2771

Download Submit
memory/1904-0-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1904-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1904-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1904-18-0x0000000000770000-0x00000000007A1000-memory.dmp

Filesize
196KB

Download
memory/1904-17-0x0000000000770000-0x00000000007A1000-memory.dmp

Filesize
196KB

Download
memory/1904-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1904-84-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1904-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1904-2-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1904-67-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2532-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-70-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2564-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-37-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/2564-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-98-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-87-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-35-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/2564-86-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-21-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2564-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-55-0x0000000000840000-0x0000000000871000-memory.dmp

Filesize
196KB

Download
memory/2668-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-39-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2668-47-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-68-0x0000000002640000-0x0000000002671000-memory.dmp

Filesize
196KB

Download
memory/2936-65-0x0000000002640000-0x0000000002671000-memory.dmp

Filesize
196KB

Download
memory/2936-89-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2936-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download