8f14b3c7d0314cc0c831a7efcf9c33f55312eb426baed4129cbfec03124d73ec

General

Target

7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
Size

65KB
MD5

7047935da79e72c80dcb04217a2d2160
SHA1

a1a4185e8170687463b31d0b2db8b30f55787f31
SHA256

8f14b3c7d0314cc0c831a7efcf9c33f55312eb426baed4129cbfec03124d73ec
SHA512

4bbb10fa969c6a3c1b32008179e3369daf8220caa9c01b05bd7c6ae0da2a56d9b8526e9e5cda3bbbe7dc822520eec6fde9f35f0fea3c11f64a2dea0c3315a5ee
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou6VVVVVVVVVVVVVVVVVVX:7WNqkOJWmo1HpM0MkTUmu6VVVVVVVVVp

Score

10^/10

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

Processes:

resource	yara_rule
behavioral2/memory/2580-35-0x00000000754F0000-0x000000007564D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

400 explorer.exe
5012 spoolsv.exe
2580 svchost.exe
3304 spoolsv.exe

pid	process
400	explorer.exe
5012	spoolsv.exe
2580	svchost.exe
3304	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

Processes:

explorer.exe7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
400	explorer.exe
400	explorer.exe
400	explorer.exe
400	explorer.exe
400	explorer.exe
400	explorer.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe
2580	svchost.exe
2580	svchost.exe
400	explorer.exe
400	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

400 explorer.exe
2580 svchost.exe

pid	process
400	explorer.exe
2580	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
400	explorer.exe
400	explorer.exe
5012	spoolsv.exe
5012	spoolsv.exe
2580	svchost.exe
2580	svchost.exe
3304	spoolsv.exe
3304	spoolsv.exe
400	explorer.exe
400	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2500 wrote to memory of 400	2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe	explorer.exe
PID 2500 wrote to memory of 400	2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe	explorer.exe
PID 2500 wrote to memory of 400	2500	7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe	explorer.exe
PID 400 wrote to memory of 5012	400	explorer.exe	spoolsv.exe
PID 400 wrote to memory of 5012	400	explorer.exe	spoolsv.exe
PID 400 wrote to memory of 5012	400	explorer.exe	spoolsv.exe
PID 5012 wrote to memory of 2580	5012	spoolsv.exe	svchost.exe
PID 5012 wrote to memory of 2580	5012	spoolsv.exe	svchost.exe
PID 5012 wrote to memory of 2580	5012	spoolsv.exe	svchost.exe
PID 2580 wrote to memory of 3304	2580	svchost.exe	spoolsv.exe
PID 2580 wrote to memory of 3304	2580	svchost.exe	spoolsv.exe
PID 2580 wrote to memory of 3304	2580	svchost.exe	spoolsv.exe
PID 2580 wrote to memory of 1668	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 1668	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 1668	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 1640	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 1640	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 1640	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 5112	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 5112	2580	svchost.exe	at.exe
PID 2580 wrote to memory of 5112	2580	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7047935da79e72c80dcb04217a2d2160_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3304

C:\Windows\SysWOW64\at.exe
at 01:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1668

C:\Windows\SysWOW64\at.exe
at 01:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1640

C:\Windows\SysWOW64\at.exe
at 01:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:5112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
65KB

MD5
74d1a682ce81385d36654711d9faf60e

SHA1
599791ff3e4e17a27347c5989149bfeccea3cee9

SHA256
a6383b403b03e0dd6ef6bcd33a9d130bbbea3c692201ce1bf64d6bb9b8780cde

SHA512
d6db2ab8a857c188b9c9ebba0128c98bd0aa615f2d97f2dce18fd7caebfe5dc7413d2b5e89166d8190c7dbaa3cfafeedc72f4a60a9ec1d08392fe906eb0d9cae

Download Submit
C:\Windows\System\explorer.exe
Filesize
65KB

MD5
22644fe7cec7c3ba6b137f1de1f7084e

SHA1
809a790e4f641cf61aca976280e9f7a1f6217fbe

SHA256
8ac1dff4e816f651411b0ca8b5251c98f6961b75280e9b72aee0ab7f0bffd553

SHA512
7bd27b91bedb15e6b711fe3ddf51a539bce858da1b82bf39dc0b5aabb57ef3c05b946ce8801d42a7ebcc3ff4f638cfd8999c5b02d26425b5ec819c7244413ed8

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
65KB

MD5
a166848b32b85809b46d5adefd5e8de7

SHA1
74769789681c5b75902810453caac8c5d8ee499c

SHA256
8ac4e1630bd3d1659d3e0f891b99aaf9f36507b9c6043adfd55e927940327288

SHA512
863f0654ce8b28b6ffe0e54c5009c8261ebf773ae37e136e00e38fffb5fc7376a6b0e3d4132f944ca50cfd7683a1d7ffe3ca5cafe3aae27fa6f2345e7f401aab

Download Submit
C:\Windows\System\svchost.exe
Filesize
65KB

MD5
a9e957174581834b24a7154165940dd8

SHA1
889ecad9cabcc41bc3cc2463a444513a5d1839cc

SHA256
e3ee0b538fc1e3ba8d665329a59a2307caa3a5a62bdab0e7370788dd9ff68ff0

SHA512
53ac74e92be3c6f1076cff387759294e8bd4c0bd9a46d0141a4ce2041f551f1c993ca994ddaac6eb39e5feb19faee975bbebf94e7e95882d54bc627b962a3afd

Download Submit
memory/400-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/400-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/400-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/400-13-0x00000000754F0000-0x000000007564D000-memory.dmp

Filesize
1.4MB

Download
memory/2500-54-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2500-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2500-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2500-2-0x00000000754F0000-0x000000007564D000-memory.dmp

Filesize
1.4MB

Download
memory/2500-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2500-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2500-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-34-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-35-0x00000000754F0000-0x000000007564D000-memory.dmp

Filesize
1.4MB

Download
memory/2580-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3304-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3304-42-0x00000000754F0000-0x000000007564D000-memory.dmp

Filesize
1.4MB

Download
memory/5012-51-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5012-24-0x00000000754F0000-0x000000007564D000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads