10ce4f31a43caf61cf34e781a0065709db62134b777713e7e0b5fb0bc2c996c0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
Size

65KB
MD5

56c3dabbbd485afe3acf887ae7e16800
SHA1

d76794906b1d67a37b9eebd6930bfcbf96650307
SHA256

10ce4f31a43caf61cf34e781a0065709db62134b777713e7e0b5fb0bc2c996c0
SHA512

ae25ce7bf009625272bf4712678de75b886f73eeff28de7b3f22d2936d5939d7c68ca00c4e087079255f0dab50112f755ce70806ad9f95b5fd8d4066ebfe0c3c
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuGFFFFFFFFFFFFFFFFFFB:7WNqkOJWmo1HpM0MkTUmu8

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/1800-38-0x0000000074BF0000-0x0000000074D4D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4728	explorer.exe
3540	spoolsv.exe
1800	svchost.exe
4208	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe
1800	svchost.exe
1800	svchost.exe
4728	explorer.exe
4728	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4728	explorer.exe
1800	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
4728	explorer.exe
4728	explorer.exe
3540	spoolsv.exe
3540	spoolsv.exe
1800	svchost.exe
1800	svchost.exe
4208	spoolsv.exe
4208	spoolsv.exe
4728	explorer.exe
4728	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4728	4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	82
PID 4768 wrote to memory of 4728	4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	82
PID 4768 wrote to memory of 4728	4768	56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe	82
PID 4728 wrote to memory of 3540	4728	explorer.exe	83
PID 4728 wrote to memory of 3540	4728	explorer.exe	83
PID 4728 wrote to memory of 3540	4728	explorer.exe	83
PID 3540 wrote to memory of 1800	3540	spoolsv.exe	84
PID 3540 wrote to memory of 1800	3540	spoolsv.exe	84
PID 3540 wrote to memory of 1800	3540	spoolsv.exe	84
PID 1800 wrote to memory of 4208	1800	svchost.exe	85
PID 1800 wrote to memory of 4208	1800	svchost.exe	85
PID 1800 wrote to memory of 4208	1800	svchost.exe	85
PID 1800 wrote to memory of 4384	1800	svchost.exe	86
PID 1800 wrote to memory of 4384	1800	svchost.exe	86
PID 1800 wrote to memory of 4384	1800	svchost.exe	86
PID 1800 wrote to memory of 3020	1800	svchost.exe	104
PID 1800 wrote to memory of 3020	1800	svchost.exe	104
PID 1800 wrote to memory of 3020	1800	svchost.exe	104
PID 1800 wrote to memory of 2492	1800	svchost.exe	109
PID 1800 wrote to memory of 2492	1800	svchost.exe	109
PID 1800 wrote to memory of 2492	1800	svchost.exe	109

C:\Users\Admin\AppData\Local\Temp\56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\56c3dabbbd485afe3acf887ae7e16800_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4728
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4208
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4384
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3020
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
f351475a9f3ca18319cbb24a0e5f5cee

SHA1
448acce1ea85c0624c3df7559acc9b6b55907e7e

SHA256
f5242bdab5982555038e212a3d7a280240e7e2fc1a7aa678a7eb5e8ae81d7811

SHA512
29d54311c6e442819e73f2a249ed6d7d8e726559bd7b66ac812414771c48d01523f67df377bb87aa06a230f46cde093ad8e9b5733e831c0d2a5643f427bdb339

Download Submit
C:\Windows\System\explorer.exe

Filesize
65KB

MD5
c4498008963f5d15ef51547766338320

SHA1
8da83349e4b1601e50b77d173134694477994f9f

SHA256
4dfebef0f764ec11adf3d9d2566f5c37be1224188e1d67047268519c9e57c24a

SHA512
65ce1d96d12af2d432a2b5b7a75e4319f588a8627a754169a285447a5e351344b1c83f3cb1d9536948a6ba5c302ececfe0a2ba429ec4bbe8c02f23e4009cbc9a

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
ef6a6005b05878b0d7a691a47565e3ec

SHA1
03cb9fa4506648d91a3eb3155cc72aae0519e761

SHA256
11ffe4189eaa22053a46a9ab522b80eb8dc941151a0fe708729ccc4e6f15f469

SHA512
439828d868440b1eaee173113b2c8059cf24c0577e52ef5570f2f1274afee154e94c078a963008c6f27256774205d702fafb332da85aa190c2ffebd99214a16c

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
2acbdbd04283e21e8d632ca508b9238b

SHA1
b4d0426a910c143c91fa675fb7ffbdeea2401895

SHA256
01b80570d440acddfa68b37a1d83d4c842f8d3782ac6ea848d98273aa477a647

SHA512
24c5d46fd7315527304816bea2656f04bf537c88024a7ac7078fa5ef13327660530f7ee1587bf1e82f0a331811e5328627e0a5d6b3e2e855259b9c8be4d5379f

Download Submit
memory/1800-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1800-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1800-38-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Filesize
1.4MB

Download
memory/3540-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3540-27-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Filesize
1.4MB

Download
memory/3540-31-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3540-26-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3540-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4208-51-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4208-45-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Filesize
1.4MB

Download
memory/4728-14-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Filesize
1.4MB

Download
memory/4728-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4728-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4728-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4728-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4768-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4768-2-0x0000000074BF0000-0x0000000074D4D000-memory.dmp

Filesize
1.4MB

Download
memory/4768-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4768-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4768-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4768-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4768-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4768-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download