cf44e81284e501e7f25764461acc98893a96fbb3e8d7ef9fb67d62e05499163e

General

Target

7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
Size

66KB
MD5

7d617d2227b39a830549a04ff72de3f0
SHA1

03c9f6ea2c44861a594a4d2c129ad9c9d3551279
SHA256

cf44e81284e501e7f25764461acc98893a96fbb3e8d7ef9fb67d62e05499163e
SHA512

c59b615792b56604ca537860de3084eb8c8d4379990c1c03e507e26b43b6f2d660f57d5a90a658cc871be699f8e815c4d48291b038bb659ff57e373cee798371
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi2:IeklMMYJhqezw/pXzH9i2

Score

10^/10

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

Processes:

resource	yara_rule
behavioral1/memory/2792-56-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2828 explorer.exe
2796 spoolsv.exe
2792 svchost.exe
2536 spoolsv.exe

pid	process
2828	explorer.exe
2796	spoolsv.exe
2792	svchost.exe
2536	spoolsv.exe

Loads dropped DLL 8 IoCs

Processes:

7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

pid	process
1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
2828	explorer.exe
2828	explorer.exe
2796	spoolsv.exe
2796	spoolsv.exe
2792	svchost.exe
2792	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2792	svchost.exe
2792	svchost.exe
2792	svchost.exe
2828	explorer.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2792	svchost.exe
2828	explorer.exe
2828	explorer.exe
2792	svchost.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe
2792	svchost.exe
2792	svchost.exe
2828	explorer.exe
2828	explorer.exe
2792	svchost.exe
2828	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2828 explorer.exe
2792 svchost.exe

pid	process
2828	explorer.exe
2792	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
2828	explorer.exe
2828	explorer.exe
2796	spoolsv.exe
2796	spoolsv.exe
2792	svchost.exe
2792	svchost.exe
2536	spoolsv.exe
2536	spoolsv.exe
2828	explorer.exe
2828	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 1792 wrote to memory of 2828	1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe	explorer.exe
PID 1792 wrote to memory of 2828	1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe	explorer.exe
PID 1792 wrote to memory of 2828	1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe	explorer.exe
PID 1792 wrote to memory of 2828	1792	7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe	explorer.exe
PID 2828 wrote to memory of 2796	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 2796	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 2796	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 2796	2828	explorer.exe	spoolsv.exe
PID 2796 wrote to memory of 2792	2796	spoolsv.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	spoolsv.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	spoolsv.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	spoolsv.exe	svchost.exe
PID 2792 wrote to memory of 2536	2792	svchost.exe	spoolsv.exe
PID 2792 wrote to memory of 2536	2792	svchost.exe	spoolsv.exe
PID 2792 wrote to memory of 2536	2792	svchost.exe	spoolsv.exe
PID 2792 wrote to memory of 2536	2792	svchost.exe	spoolsv.exe
PID 2792 wrote to memory of 1976	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1976	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1976	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1976	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1620	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1620	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1620	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 1620	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 652	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 652	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 652	2792	svchost.exe	at.exe
PID 2792 wrote to memory of 652	2792	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7d617d2227b39a830549a04ff72de3f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2536

C:\Windows\SysWOW64\at.exe
at 03:00 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1976

C:\Windows\SysWOW64\at.exe
at 03:01 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:1620

C:\Windows\SysWOW64\at.exe
at 03:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
5⤵
PID:652

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
66KB

MD5
e7c4656107754513cdee667bca08d1a2

SHA1
9be682c472de6883ef7df89e2743f904a1b3b98c

SHA256
91b00789aa75565940d37e1461dcab78196839df16fc0aac94f276cd2eda4fd0

SHA512
9a5c8eb9b14354013ca82b42d3d6537a0a6738a5b9bf24b7568dc87eafa76311decf7f2f9512bde7ac538c037209b47cbf17eb67b9fc706adf5d74e4748014df

Download Submit
\??\PIPE\atsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\system\explorer.exe
Filesize
66KB

MD5
d7757db2bb27ec9605ebff36008c4b42

SHA1
7967ba33fbfcdb3b9d9c497bd7c58d998717f104

SHA256
7a159acc83a0ed89e29a151ea004a7ac9075141dc7b3ab282184e67f93568444

SHA512
8851c2228d1f7b868f0f9b2f9685b34f1c143bbac9f6111c4d8913e6c8acab93bdf44f34cb02e1ab2be1e6a113017850a47dd3d0be6b14b19e1aaecb6b85da5f

Download Submit
\Windows\system\spoolsv.exe
Filesize
66KB

MD5
9c024afc4c63fc2a125c7ed2af391a3b

SHA1
b5279b9a392de8ff27f739318194dc615fe781e5

SHA256
d7a9a853fa7413394a76e5bbd47204cfe12bcc2e2a118b2f65aa0b9b4a16c201

SHA512
d7c4af139e3f3288bfcb177a13b39c28012f984e2ed59412c9d6582ee04e65433228968a158c9cb21a74f7ae17d44718fd5f2930b0bb06356f3c5cd81341ddc1

Download Submit
\Windows\system\svchost.exe
Filesize
66KB

MD5
f3f8f76c23a5dfddd81955893ad159c4

SHA1
606225cd864bd24dac8f403064734a1356ceea3c

SHA256
4d4eb65d57734ddd958a3aee00bf52728d30107cd19bed675fe452888091e9c2

SHA512
b013eb7a31235431ead7b2e7b767837b310362c9015eb701464fe621923b211f075df7f37ad0c09ef48442581c4d0f80ae8f35e557f11a95b5ffd96acf723a8b

Download Submit
memory/1792-19-0x0000000000570000-0x00000000005A1000-memory.dmp

Filesize
196KB

Download
memory/1792-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1792-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1792-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1792-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1792-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1792-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1792-12-0x0000000000570000-0x00000000005A1000-memory.dmp

Filesize
196KB

Download
memory/1792-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2536-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2536-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2536-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2792-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2792-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2796-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2796-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2796-54-0x0000000002B20000-0x0000000002B51000-memory.dmp

Filesize
196KB

Download
memory/2796-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2828-41-0x0000000002830000-0x0000000002861000-memory.dmp

Filesize
196KB

Download
memory/2828-31-0x0000000002830000-0x0000000002861000-memory.dmp

Filesize
196KB

Download
memory/2828-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2828-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2828-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2828-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2828-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads