3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
Size

66KB
MD5

b105f60607582574f11caf1e2aeb0cb0
SHA1

4118aeaba2a85060baba2e2b048061fdd8962d72
SHA256

3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45
SHA512

5500c191fc6093e133cdb4ef145373a16b7aa4087fc64e56b7e5fc83b73653992ead932f98f1cafddd543999890739facf0486460f75efe969c4aece9a8e6569
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiW:IeklMMYJhqezw/pXzH9iW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/2892-38-0x00000000752A0000-0x00000000753FD000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2704	explorer.exe
3408	spoolsv.exe
2892	svchost.exe
2856	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe
2892	svchost.exe
2892	svchost.exe
2704	explorer.exe
2704	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2704	explorer.exe
2892	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
2704	explorer.exe
2704	explorer.exe
3408	spoolsv.exe
3408	spoolsv.exe
2892	svchost.exe
2892	svchost.exe
2856	spoolsv.exe
2856	spoolsv.exe
2704	explorer.exe
2704	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2704	4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	82
PID 4384 wrote to memory of 2704	4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	82
PID 4384 wrote to memory of 2704	4384	3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe	82
PID 2704 wrote to memory of 3408	2704	explorer.exe	83
PID 2704 wrote to memory of 3408	2704	explorer.exe	83
PID 2704 wrote to memory of 3408	2704	explorer.exe	83
PID 3408 wrote to memory of 2892	3408	spoolsv.exe	84
PID 3408 wrote to memory of 2892	3408	spoolsv.exe	84
PID 3408 wrote to memory of 2892	3408	spoolsv.exe	84
PID 2892 wrote to memory of 2856	2892	svchost.exe	85
PID 2892 wrote to memory of 2856	2892	svchost.exe	85
PID 2892 wrote to memory of 2856	2892	svchost.exe	85
PID 2892 wrote to memory of 2684	2892	svchost.exe	87
PID 2892 wrote to memory of 2684	2892	svchost.exe	87
PID 2892 wrote to memory of 2684	2892	svchost.exe	87
PID 2892 wrote to memory of 1460	2892	svchost.exe	103
PID 2892 wrote to memory of 1460	2892	svchost.exe	103
PID 2892 wrote to memory of 1460	2892	svchost.exe	103
PID 2892 wrote to memory of 3696	2892	svchost.exe	112
PID 2892 wrote to memory of 3696	2892	svchost.exe	112
PID 2892 wrote to memory of 3696	2892	svchost.exe	112

C:\Users\Admin\AppData\Local\Temp\3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3053f39320e0e0d7d8c776d1067c599736ac16b5c24a3e4ba7992bf991c0fa45_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2684
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1460
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
40d6eb543eaa48214a05cdb486a71feb

SHA1
3e785a5501a546dff6a35fa480e99e5905ca3951

SHA256
b068a9cab54f1553246a07d0483b614f30dcf6955bf1e0e671a5ad97e41ac47d

SHA512
384c38c16a271086a8cf2b6712eeeb59a57a627e1c08f55d743ac0ad1e35d34539d7ba47dfcfc3da636b4d8c712a8916aaf01e565e833bb8d820ce178449ec97

Download Submit
C:\Windows\System\explorer.exe

Filesize
66KB

MD5
10b1133e2ba38f63508b5ff4b90dcb86

SHA1
28d026598d111e9aa2da861e681f31b6f3c5a5e2

SHA256
87857d8a14a990986bb7f9f3b892c4445673368b4c93c8a461357bfbf09c0a8a

SHA512
adbfb4bb31c452bca583876c03e42f7a9e104a23d3825b7e2008e513201ee333418030ad73a6ebf95b62093fa7a4844cdd0fd91b84ebd2c27ab1e43f459ab684

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
2a593ab07e8b5c1b7f3fb12ef600dc3d

SHA1
da3efc55597bce8832b2a66513160ae369cd5076

SHA256
9003e2bcb9bc1d2508bd684e5f45f9a6a04ea53f2001d1406a9e4f5f32da115c

SHA512
8b797fbd87b6f6f00bd0a802852592bdd6b9617365e7aaf1a78706601952b6c92ce4d3865f72e740eb6faefbedb4f20b43b81a883c6ebc66160b478444ee6002

Download Submit
C:\Windows\System\svchost.exe

Filesize
66KB

MD5
ac963d898ca847fbf4f61ee41dcfda7b

SHA1
4fc1383439c82da0465bd81368e66a3405a745eb

SHA256
69d14661ba5a9299205dad2b9c1965e5321e082fa489c6105d7a8670c9db9085

SHA512
53c8032aa921e166085c7fc2538af0c2a14e86c9665c01eba36afcd2306d51de7c6e4d341514dfaddafd039c7c997f74da76e22bead2e77dad61b67974071dbd

Download Submit
memory/2704-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2704-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2704-13-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/2704-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-51-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2856-45-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/2892-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-38-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/2892-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3408-26-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/3408-30-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3408-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3408-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3408-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4384-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4384-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4384-5-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4384-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4384-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4384-2-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/4384-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download