57f8129e5cc0e04a4dd88ee9247eed9fa9693d60c08e3f9d73490da96c874210

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
Size 66KB
Sample240526-cz4arscd79
SHA256 57f8129e5cc0e04a4dd88ee9247eed9fa9693d60c08e3f9d73490da96c874210
MD5 5331aff74c1782c5b45c6cf95bc002a0
SHA1 ea0ad192a6e0030cf78421dfffea7d3b08933a78
SHA512 f4dd77670040ba4bd1a105fcee60d490a8ede6a3af5d2cf10975e30264dce41e9c4cd23858ff5e22aaa2da8f891ec766328f497a21a079d90f65fa3dbef0bf03
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiw:IeklMMYJhqezw/pXzH9iw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/1020-37-0x00000000757E0000-0x000000007593D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1432	explorer.exe
4964	spoolsv.exe
1020	svchost.exe
2032	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe
1432	explorer.exe
1432	explorer.exe
1020	svchost.exe
1432	explorer.exe
1020	svchost.exe
1020	svchost.exe
1432	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1432	explorer.exe
1020	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
1432	explorer.exe
1432	explorer.exe
4964	spoolsv.exe
4964	spoolsv.exe
1020	svchost.exe
1020	svchost.exe
2032	spoolsv.exe
2032	spoolsv.exe
1432	explorer.exe
1432	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1432	1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe	83
PID 1692 wrote to memory of 1432	1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe	83
PID 1692 wrote to memory of 1432	1692	5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe	83
PID 1432 wrote to memory of 4964	1432	explorer.exe	84
PID 1432 wrote to memory of 4964	1432	explorer.exe	84
PID 1432 wrote to memory of 4964	1432	explorer.exe	84
PID 4964 wrote to memory of 1020	4964	spoolsv.exe	85
PID 4964 wrote to memory of 1020	4964	spoolsv.exe	85
PID 4964 wrote to memory of 1020	4964	spoolsv.exe	85
PID 1020 wrote to memory of 2032	1020	svchost.exe	87
PID 1020 wrote to memory of 2032	1020	svchost.exe	87
PID 1020 wrote to memory of 2032	1020	svchost.exe	87
PID 1020 wrote to memory of 4844	1020	svchost.exe	88
PID 1020 wrote to memory of 4844	1020	svchost.exe	88
PID 1020 wrote to memory of 4844	1020	svchost.exe	88
PID 1020 wrote to memory of 2032	1020	svchost.exe	104
PID 1020 wrote to memory of 2032	1020	svchost.exe	104
PID 1020 wrote to memory of 2032	1020	svchost.exe	104
PID 1020 wrote to memory of 4548	1020	svchost.exe	113
PID 1020 wrote to memory of 4548	1020	svchost.exe	113
PID 1020 wrote to memory of 4548	1020	svchost.exe	113

C:\Users\Admin\AppData\Local\Temp\5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5331aff74c1782c5b45c6cf95bc002a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1432
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4844
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 a4093a01d736d89456d95c3503433e1af17442136ac497376ed5379c0bb32165
MD5 42cac2cab4485030eddb103971066780
SHA1 ce30ee3e5b1e3de8748416e18c974966ca7cba74
SHA512 0e887d1b351904f2cdc964d9cc044cdeeb336bc2c310e09267983caf281448dda7463259024edb4b03a7b4868abcb21d4eb1441fcf38d92bcab3288085313320
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiq:IeklMMYJhqezw/pXzH9iq
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 d822f68331adb085ad575a99dad6dce02a1530905c26bd77f84e7e3717586cee
MD5 961742eff6302953af07ca4174c82209
SHA1 0e0a4b00ea614267a5110b3e112344dc58ebb134
SHA512 e3a3a50ad0855489ca37344114bd839f84b194f0488fb062010345a603b5aa78d4edc59d59d5fef1180fe49ca4ecc5dee049ef8bebfa0dbfc03d8b31bdbd28eb
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiH:IeklMMYJhqezw/pXzH9iH
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 cc579cf13faabb104faec982823f44b25e3351355fa6095575f79feb341de9b0
MD5 e349ea8716b48ff326807524b6b12ed5
SHA1 96c9914f389fe27afb824960aa7b91180043b1ac
SHA512 541cc812ba6992dfc8fec71ec7f1db9581d969f8642c6bf6eca35c2cd961664779245a29984bbb4a0a05a01592e51abeae5f2a982db966856325bc1c24b9d07a
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiA66666666666666666666G:IeklMMYJhqezw/pXzH9iF
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 c3fb3c73b70a12f26328d82d0cc7baa8e82b8d245eb254aa27cb36b4cd2700f4
MD5 9fed5139e002c2138d9e3939d1826087
SHA1 4e7c65d73799d0b5982edc584144f54a9eeb95dc
SHA512 070e93e1e644af501ffc76dab655db1777004134fcc0a45b1e92a77544a94e0661061e71d1f8ae3f51628e09a407acc3cbd4ae55fc63b4f9f85a0b61d1ae7b1b
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiX:IeklMMYJhqezw/pXzH9iX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1020-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1020-37-0x00000000757E0000-0x000000007593D000-memory.dmp

Download

memory/1020-36-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1432-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1432-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1432-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1432-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1432-14-0x00000000757E0000-0x000000007593D000-memory.dmp

Download

memory/1692-2-0x00000000757E0000-0x000000007593D000-memory.dmp

Download

memory/1692-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1692-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1692-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1692-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1692-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1692-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2032-44-0x00000000757E0000-0x000000007593D000-memory.dmp

Download

memory/2032-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4964-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4964-26-0x00000000757E0000-0x000000007593D000-memory.dmp

Download

memory/4964-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download