4a89cd2c6c8bebcf9e8c4f43977d1e520883f6b8ef08695335d8351a9758ed00

General

Target

426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
Size

66KB
MD5

426f538e64d49d650dca734cc8157a00
SHA1

84df011a8c81fa16dfe5b6e9f738c3e84857c462
SHA256

4a89cd2c6c8bebcf9e8c4f43977d1e520883f6b8ef08695335d8351a9758ed00
SHA512

203537dd2471336b524e1844f1b0ed1185f3645c379a3100044acd088700a4d64e1bba7ec39c299fe36c338a8b7a2446ed008f9b6c12583fedcddef425768f79
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXib:IeklMMYJhqezw/pXzH9ib

Score

10^/10

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

Processes:

resource	yara_rule
behavioral2/memory/2568-37-0x0000000074F70000-0x00000000750CD000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

228 explorer.exe
4944 spoolsv.exe
2568 svchost.exe
3276 spoolsv.exe

pid	process
228	explorer.exe
4944	spoolsv.exe
2568	svchost.exe
3276	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exeexplorer.exe426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
228	explorer.exe
228	explorer.exe
228	explorer.exe
228	explorer.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe
228	explorer.exe
228	explorer.exe
2568	svchost.exe
2568	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

228 explorer.exe
2568 svchost.exe

pid	process
228	explorer.exe
2568	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
228	explorer.exe
228	explorer.exe
4944	spoolsv.exe
4944	spoolsv.exe
2568	svchost.exe
2568	svchost.exe
3276	spoolsv.exe
3276	spoolsv.exe
228	explorer.exe
228	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 1428 wrote to memory of 228	1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe	explorer.exe
PID 1428 wrote to memory of 228	1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe	explorer.exe
PID 1428 wrote to memory of 228	1428	426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe	explorer.exe
PID 228 wrote to memory of 4944	228	explorer.exe	spoolsv.exe
PID 228 wrote to memory of 4944	228	explorer.exe	spoolsv.exe
PID 228 wrote to memory of 4944	228	explorer.exe	spoolsv.exe
PID 4944 wrote to memory of 2568	4944	spoolsv.exe	svchost.exe
PID 4944 wrote to memory of 2568	4944	spoolsv.exe	svchost.exe
PID 4944 wrote to memory of 2568	4944	spoolsv.exe	svchost.exe
PID 2568 wrote to memory of 3276	2568	svchost.exe	spoolsv.exe
PID 2568 wrote to memory of 3276	2568	svchost.exe	spoolsv.exe
PID 2568 wrote to memory of 3276	2568	svchost.exe	spoolsv.exe
PID 2568 wrote to memory of 2452	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 2452	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 2452	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 232	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 232	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 232	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 3012	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 3012	2568	svchost.exe	at.exe
PID 2568 wrote to memory of 3012	2568	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\426f538e64d49d650dca734cc8157a00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Windows\SysWOW64\at.exe
at 21:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:2452

C:\Windows\SysWOW64\at.exe
at 21:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:232

C:\Windows\SysWOW64\at.exe
at 21:44 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
1⤵
PID:3272

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
66KB

MD5
1008aec4193df5ebb3538eca6fda9b03

SHA1
aa283cd23a8fff6e73ca2c8279922ed1780a4ab0

SHA256
942e2aa3b012a43e49b763fe9196e84f71691fa41b41350dcedc82ea0f8a5c75

SHA512
09e42d0d2b9c35b2ce9a9e4ff27dba18297f2494431fe4a3c01a9ed8d4b88d6512fb0bebd03764e80da3c988bdd31935a6c62af058ca15e6fea6a237453ee389

Download Submit
C:\Windows\System\explorer.exe
Filesize
66KB

MD5
8d5e090b70ad69b34cc5474a8c2c2178

SHA1
1fb0e8ccb85fd45a62c1c1152ce24d0743147650

SHA256
e8969160b3c0d52b991ff3d5dfcdc2eb1ae705f0f39952749e6297fa01e29726

SHA512
6f7bd716939c44661e64f261ea11a2cf1c0ad068f9f7191404b77371c9a89c05305019a1f94582d60013b1541966037ea992c5eea4709c9fd97de62e7bbf8480

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
66KB

MD5
696b1b55867555ab2553ae7d1d4abbc0

SHA1
4387f9b6dae0e5362cd1ea9f3fcfb45df486b505

SHA256
bad91f2bcddabcdd7e012ee3ffa2c8ab32f467094ba7cbc2ad1107204af86e80

SHA512
d710b10802d2dcc5f20684ef78140159a406bb322a09db749550e66c0d67d7cd27ae5ba732ac722cc5643f9e427f43ce3999a8c54c4de2c5d747e5ad6145cdb3

Download Submit
\??\c:\windows\system\svchost.exe
Filesize
66KB

MD5
96035bae06f0e1de4884b2cbc7fa121d

SHA1
2091b0f5e3f977a75f282d493d61efa1b703b4d1

SHA256
832df126a21b51eb93f3b8a474a07943cf2ed692b07cf808ae0689f86cc8772e

SHA512
995eec9f452e08b5e43add016e3b7585a03ac3ab8397d8b1593c6098a55ef9aacc79c3a6672754fa6c1a79b9f4c807ad503a3456045b5fc49356746d7540c525

Download Submit
memory/228-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/228-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/228-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/228-14-0x0000000074F70000-0x00000000750CD000-memory.dmp

Filesize
1.4MB

Download
memory/228-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1428-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1428-6-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1428-2-0x0000000074F70000-0x00000000750CD000-memory.dmp

Filesize
1.4MB

Download
memory/1428-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1428-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2568-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2568-37-0x0000000074F70000-0x00000000750CD000-memory.dmp

Filesize
1.4MB

Download
memory/2568-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3276-44-0x0000000074F70000-0x00000000750CD000-memory.dmp

Filesize
1.4MB

Download
memory/3276-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4944-30-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4944-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4944-26-0x0000000074F70000-0x00000000750CD000-memory.dmp

Filesize
1.4MB

Download
memory/4944-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads