3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
Size

66KB
MD5

b105f60607582574f11caf1e2aeb0cb0
SHA1

4118aeaba2a85060baba2e2b048061fdd8962d72
SHA256

3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45
SHA512

5500c191fc6093e133cdb4ef145373a16b7aa4087fc64e56b7e5fc83b73653992ead932f98f1cafddd543999890739facf0486460f75efe969c4aece9a8e6569
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiW:IeklMMYJhqezw/pXzH9iW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2572-53-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2552	explorer.exe
2540	spoolsv.exe
2572	svchost.exe
2960	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
2552	explorer.exe
2552	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2572	svchost.exe
2572	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2572	svchost.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe
2572	svchost.exe
2552	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2552	explorer.exe
2572	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
2552	explorer.exe
2552	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2572	svchost.exe
2572	svchost.exe
2960	spoolsv.exe
2960	spoolsv.exe
2552	explorer.exe
2552	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2552	1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	28
PID 1728 wrote to memory of 2552	1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	28
PID 1728 wrote to memory of 2552	1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	28
PID 1728 wrote to memory of 2552	1728	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	28
PID 2552 wrote to memory of 2540	2552	explorer.exe	29
PID 2552 wrote to memory of 2540	2552	explorer.exe	29
PID 2552 wrote to memory of 2540	2552	explorer.exe	29
PID 2552 wrote to memory of 2540	2552	explorer.exe	29
PID 2540 wrote to memory of 2572	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2572	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2572	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2572	2540	spoolsv.exe	30
PID 2572 wrote to memory of 2960	2572	svchost.exe	31
PID 2572 wrote to memory of 2960	2572	svchost.exe	31
PID 2572 wrote to memory of 2960	2572	svchost.exe	31
PID 2572 wrote to memory of 2960	2572	svchost.exe	31
PID 2572 wrote to memory of 2816	2572	svchost.exe	32
PID 2572 wrote to memory of 2816	2572	svchost.exe	32
PID 2572 wrote to memory of 2816	2572	svchost.exe	32
PID 2572 wrote to memory of 2816	2572	svchost.exe	32
PID 2572 wrote to memory of 2268	2572	svchost.exe	36
PID 2572 wrote to memory of 2268	2572	svchost.exe	36
PID 2572 wrote to memory of 2268	2572	svchost.exe	36
PID 2572 wrote to memory of 2268	2572	svchost.exe	36
PID 2572 wrote to memory of 1100	2572	svchost.exe	38
PID 2572 wrote to memory of 1100	2572	svchost.exe	38
PID 2572 wrote to memory of 1100	2572	svchost.exe	38
PID 2572 wrote to memory of 1100	2572	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2816
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2268
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
be0e60b4bfe183a5f5079c7eeb89b653

SHA1
3bd40497880dde68c6fae97c19b745c28bbeaeb4

SHA256
7c5495b48ce18a930a1c1d0e31eadb94a1796177ccb05e52724b4b727ba57173

SHA512
c8b563ba697ca8ef320a555a075581b5e22888ed88dd229f8f8e462a4ffbe1cc066a46fc5d48c113c0c21b3ee2f43776d4c00d1da90d8bc461fad8b8e15e367e

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
2ffb756c1148f9e9f6c1066fa5507e2d

SHA1
060376227aabcf0ddb5d54ab014147e0af4c5b79

SHA256
78002731949e0e5c8865f5874b822c5d382105ab7a6aca21450b673f1b16fdae

SHA512
250a4041dde4502483cfc3331a43ec66d99411d6135547d9a8c40aa47128afda3133f3e97c9e35ce8b02b8adba09520b2e4d275aeeda5881bc75b22ca731dcfa

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
6fd58e03cab34c12591f068863c066b8

SHA1
4b73908d7fc399493a68095d41aed2f8c29963f3

SHA256
3b52cdd400de970dab9c090ab89a9005e7dcf25a218e5b30d6664efd0ecda9ff

SHA512
015803649c358519af7b62eb4273074206bb0bd2d298a2ca6252669a55094ad200a494b0d3c5dfb0c41c421289cc98f683791f067986885bd796456c65df9ed9

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
eda62dcc2c186de7de7fd69007dd5a67

SHA1
518643c591b24b3c97fcda1b2105525a22b5dc59

SHA256
cbad4151709483d1d790e2c9571d7ebaaf3be3946294162a4c6e887c8cfd79d5

SHA512
fc2ec592d36f8c94104b7aaeaa74679c52768a5c34f26a234eb6ba1ed45b76c0241c2800e6f10a60420bb2a4a2ce1794b480456dec4bdaa40dec5438497f2529

Download Submit
memory/1728-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1728-12-0x0000000002740000-0x0000000002771000-memory.dmp

Filesize
196KB

Download
memory/1728-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1728-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1728-20-0x0000000002740000-0x0000000002771000-memory.dmp

Filesize
196KB

Download
memory/1728-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1728-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1728-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1728-65-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1728-57-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1728-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2540-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2552-35-0x0000000002460000-0x0000000002491000-memory.dmp

Filesize
196KB

Download
memory/2552-34-0x0000000002460000-0x0000000002491000-memory.dmp

Filesize
196KB

Download
memory/2552-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2552-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2552-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2552-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-66-0x0000000002890000-0x00000000028C1000-memory.dmp

Filesize
196KB

Download
memory/2572-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-53-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2572-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2960-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2960-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download