10ce4f31a43caf61cf34e781a0065709db62134b777713e7e0b5fb0bc2c996c0

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
Size

65KB
MD5

56c3dabbbd485afe3acf887ae7e16800
SHA1

d76794906b1d67a37b9eebd6930bfcbf96650307
SHA256

10ce4f31a43caf61cf34e781a0065709db62134b777713e7e0b5fb0bc2c996c0
SHA512

ae25ce7bf009625272bf4712678de75b886f73eeff28de7b3f22d2936d5939d7c68ca00c4e087079255f0dab50112f755ce70806ad9f95b5fd8d4066ebfe0c3c
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuGFFFFFFFFFFFFFFFFFFB:7WNqkOJWmo1HpM0MkTUmu8

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2464-54-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2008	explorer.exe
2336	spoolsv.exe
2464	svchost.exe
2784	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
2008	explorer.exe
2008	explorer.exe
2336	spoolsv.exe
2336	spoolsv.exe
2464	svchost.exe
2464	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe
2008	explorer.exe
2008	explorer.exe
2464	svchost.exe
2464	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2008	explorer.exe
2464	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
2008	explorer.exe
2008	explorer.exe
2336	spoolsv.exe
2336	spoolsv.exe
2464	svchost.exe
2464	svchost.exe
2784	spoolsv.exe
2784	spoolsv.exe
2008	explorer.exe
2008	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2008	2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	28
PID 2916 wrote to memory of 2008	2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	28
PID 2916 wrote to memory of 2008	2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	28
PID 2916 wrote to memory of 2008	2916	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	28
PID 2008 wrote to memory of 2336	2008	explorer.exe	29
PID 2008 wrote to memory of 2336	2008	explorer.exe	29
PID 2008 wrote to memory of 2336	2008	explorer.exe	29
PID 2008 wrote to memory of 2336	2008	explorer.exe	29
PID 2336 wrote to memory of 2464	2336	spoolsv.exe	30
PID 2336 wrote to memory of 2464	2336	spoolsv.exe	30
PID 2336 wrote to memory of 2464	2336	spoolsv.exe	30
PID 2336 wrote to memory of 2464	2336	spoolsv.exe	30
PID 2464 wrote to memory of 2784	2464	svchost.exe	31
PID 2464 wrote to memory of 2784	2464	svchost.exe	31
PID 2464 wrote to memory of 2784	2464	svchost.exe	31
PID 2464 wrote to memory of 2784	2464	svchost.exe	31
PID 2464 wrote to memory of 2564	2464	svchost.exe	32
PID 2464 wrote to memory of 2564	2464	svchost.exe	32
PID 2464 wrote to memory of 2564	2464	svchost.exe	32
PID 2464 wrote to memory of 2564	2464	svchost.exe	32
PID 2464 wrote to memory of 768	2464	svchost.exe	36
PID 2464 wrote to memory of 768	2464	svchost.exe	36
PID 2464 wrote to memory of 768	2464	svchost.exe	36
PID 2464 wrote to memory of 768	2464	svchost.exe	36
PID 2464 wrote to memory of 1728	2464	svchost.exe	38
PID 2464 wrote to memory of 1728	2464	svchost.exe	38
PID 2464 wrote to memory of 1728	2464	svchost.exe	38
PID 2464 wrote to memory of 1728	2464	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:768
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
f4b78ebc5036e9790bff21a3a25dcd4a

SHA1
ca5d419fd8caec25ebcf74457f0672034ef2b259

SHA256
efa61fa9fbf96ecf281ec97de6f78b5cddd89e9a90a2fc676f9a6814eb204c37

SHA512
ae4351f837d419d0c2630f78c42a2c841bf974fcfba8c0534a40f41bd14a9f83c64b09deba88ab8b20ed5e036e1cae3b2e58e3d02a46e9dfccf471cda3233f4b

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
65KB

MD5
267e8d0e9accca37be0b712b53b3ef47

SHA1
3c7fe676232b9ae9cc38cbb7d75d65c20bea843d

SHA256
d12be3c015a99516bc30a9eb3a90761ba25a9041f8c9fdbb577191b14bf1dfda

SHA512
d568cd7b594dfd7cd87fe5cd93ad329e08c764df6d575ab959e2f43b3809f74c437ae59934d51ccd7cc59fb2416998b9b355d3714cede7ca25c6787bb0ae03ad

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
f3e09f8aebda0a1c524eb73ad20e6649

SHA1
8178f76f43496a98c8062fe1ccb02c7514ddf772

SHA256
0a4189208aecef4882a4ce69ac2e1cc5cd8afae68d0e28162fdaa574a8d3f483

SHA512
0f4b074178bb5f306d616e192fa9c94b490c05b51e34ca7816b658f0c87213459edee29cf55ba52f833bb8490f26dbc239a488abc46986444c1fb4167b3a15a4

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
d47df085ad12cd9773d3cd2cb737a216

SHA1
f91b9b5e284f21d9c4ba1ee70cc9a2daa9a551c3

SHA256
fdec99a5dede633bd2429c8d4af9bdd0ca2ad84954e2e97d6c7759529a0bb1ad

SHA512
7f4e9ad4df72e182283c46b50603e0d2a9f709d0d6e277560cb1f9981c4820ade1fb58ec97266d1d0b96919ebd4e0e8b79186143102e5b29983fe84b179b2029

Download Submit
memory/2008-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2008-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2008-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2008-34-0x0000000002B60000-0x0000000002B91000-memory.dmp

Filesize
196KB

Download
memory/2008-89-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2008-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2336-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2336-35-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2336-39-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2336-51-0x0000000002480000-0x00000000024B1000-memory.dmp

Filesize
196KB

Download
memory/2464-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2464-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2464-64-0x0000000002740000-0x0000000002771000-memory.dmp

Filesize
196KB

Download
memory/2784-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2784-65-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2916-50-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2916-53-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2916-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2916-13-0x0000000002720000-0x0000000002751000-memory.dmp

Filesize
196KB

Download
memory/2916-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2916-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2916-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2916-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2916-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download