Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:35

General

  • Target

    5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe

  • Size

    65KB

  • MD5

    5c8240c58187f307d35c51c079639ff0

  • SHA1

    ffc92d800d8f4c7c12f70c9047c46beae5c9efe8

  • SHA256

    a232079f2c9dd01e7105ac504d50a4ad8ceb75ae9a9285e003f14381251830be

  • SHA512

    4e22a15e6eb7123588d4af0027a971f5f1711e0c0e556e9730af413ce33c11a1a15ffc8d17bd2768e884f88318e8225a9f9f60e33a28ef4f083b511f3cf19ee4

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuHtttttttttttttttttt8:7WNqkOJWmo1HpM0MkTUmuHttttttttty

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1948
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2336
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2572
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1736
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2660
          • C:\Windows\SysWOW64\at.exe
            at 03:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2884
            • C:\Windows\SysWOW64\at.exe
              at 03:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:592
              • C:\Windows\SysWOW64\at.exe
                at 03:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:560

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                65KB

                MD5

                6f02be24e1135f5a998673fba3d54cf7

                SHA1

                be633c1227c6f365ab13d262f313d64376eef233

                SHA256

                517ecc499d897417c7280639c267dc8a9c8701d4d409e3f7b1cbe17ed462d01d

                SHA512

                ae7a16f43cc5c999976e40acfe18bc28f05b0a8daf68cab9552c5cfe26676ba3e05fe4e973b162804827030bee7e4f87283a6c1f8cf377655b65d5c8415067aa

              • \Windows\system\explorer.exe

                Filesize

                65KB

                MD5

                8ab8b61ff4a32028f27c2dae64e45792

                SHA1

                c7cf4fb4711e57b050daa320d336db10580eb7a7

                SHA256

                8a2b1abbc005ac6244168d90d04786279de103e96646325b2ef83f2cd055ec39

                SHA512

                f7c55786724e573a1c616cb0358b76d1a1b3d0fff1b0eeae92a0c9c64eb61dd0537238dcefa20716228cf1928578e407464141c9514140ae0a8ee7253be1c4ff

              • \Windows\system\spoolsv.exe

                Filesize

                65KB

                MD5

                98b7a63e3f909aed7801eecf4b4aa41d

                SHA1

                712caec4bb8ed7790856d9ecdb8bf98aa1d63ad4

                SHA256

                ed14a3ee572a6605f998cab1b8d1b3357012a2006d287c65b9ec33f4809966b2

                SHA512

                5cf6e669a79b3eaac016c4e3bff234cd376339c3347516cd8aa14296062f097ec8096c2f01e17de0160693eb97cf430a3ecf189f99dbee04cc0c146257625741

              • \Windows\system\svchost.exe

                Filesize

                65KB

                MD5

                b547ea416b127007f0e0ed3c4e7ba55b

                SHA1

                63f0898ffe66122a9624a28acd147bd71921a1d4

                SHA256

                701cd59ccbccb02443e8c8b8fa429d859b2a0797fb5fe159667e0276c5bfdb8f

                SHA512

                0ffa482d20b43a4ab8f80d3d39848b4c73b1034fffbde57f79f894f0b39b14cc718162a6a9a618117569e1c9580e1756f841c5bdb814c6b9b92d5882021a4a03

              • memory/1736-67-0x0000000002590000-0x00000000025C1000-memory.dmp

                Filesize

                196KB

              • memory/1736-68-0x0000000002590000-0x00000000025C1000-memory.dmp

                Filesize

                196KB

              • memory/1736-55-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/1736-61-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1736-86-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1948-12-0x0000000002720000-0x0000000002751000-memory.dmp

                Filesize

                196KB

              • memory/1948-4-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1948-20-0x0000000002720000-0x0000000002751000-memory.dmp

                Filesize

                196KB

              • memory/1948-82-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1948-1-0x0000000000020000-0x0000000000024000-memory.dmp

                Filesize

                16KB

              • memory/1948-66-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1948-0-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1948-3-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1948-59-0x0000000000020000-0x0000000000024000-memory.dmp

                Filesize

                16KB

              • memory/1948-81-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1948-2-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2336-21-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2336-84-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2336-18-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2336-35-0x0000000003130000-0x0000000003161000-memory.dmp

                Filesize

                196KB

              • memory/2336-95-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2572-53-0x0000000001E80000-0x0000000001EB1000-memory.dmp

                Filesize

                196KB

              • memory/2572-79-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2572-54-0x0000000001E80000-0x0000000001EB1000-memory.dmp

                Filesize

                196KB

              • memory/2572-41-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2572-37-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2572-36-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2660-75-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2660-69-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB