Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:35

General

  • Target

    5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe

  • Size

    65KB

  • MD5

    5c8240c58187f307d35c51c079639ff0

  • SHA1

    ffc92d800d8f4c7c12f70c9047c46beae5c9efe8

  • SHA256

    a232079f2c9dd01e7105ac504d50a4ad8ceb75ae9a9285e003f14381251830be

  • SHA512

    4e22a15e6eb7123588d4af0027a971f5f1711e0c0e556e9730af413ce33c11a1a15ffc8d17bd2768e884f88318e8225a9f9f60e33a28ef4f083b511f3cf19ee4

  • SSDEEP

    1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuHtttttttttttttttttt8:7WNqkOJWmo1HpM0MkTUmuHttttttttty

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3764
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3192
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2788
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4412
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3680
          • C:\Windows\SysWOW64\at.exe
            at 03:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1356
            • C:\Windows\SysWOW64\at.exe
              at 03:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1440
              • C:\Windows\SysWOW64\at.exe
                at 03:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2292

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                65KB

                MD5

                9bb2a21fd9ea8497338ad064f3a79e6c

                SHA1

                b03f54c3f02b0f7ce116edc4080909832ee37543

                SHA256

                8a206c442e38f68356a02d0e4bc57eb9fe76bfa11578695d3ee698b06744a753

                SHA512

                e818034a939f632afe231c7f454c6d82f7ca77f6e1e75afa8d6ce6dfc23f11c48338d2f1bdbe1a09a0982597dc21803c8c5eecb23654b7550f15de16813b65b6

              • C:\Windows\System\explorer.exe

                Filesize

                65KB

                MD5

                69c98a1512d4ddbca4dd75ece612bc39

                SHA1

                feed0f854caa46446c17fe566f7f22b8fe0e733e

                SHA256

                79091a059087cd0b668f7745a72e7904c90f231aed8605752215702a7652dc5f

                SHA512

                2d6007c78dbf4b9f9d131a045f4beb4a1b9ee98d3879b8a76c5753a6067d128d869bd90c3dc66e9d093c0e6400d1f137188e5ef1fb2d5eb02bb464c5f2fa0051

              • C:\Windows\System\spoolsv.exe

                Filesize

                65KB

                MD5

                bb6b27eec0ab459285af071fc0b49664

                SHA1

                0eb369557d711436c340aedc751b0f793e430ba5

                SHA256

                92696ce6b182559235780a21fead09ba5072e0bb0519d8a77bccf9d85d1c8d7f

                SHA512

                7b83d9f47833045408cc4dafa3db624b759822bd5453df861da2e60ffd4eeb2aa39c119e35cfb659da81e1d5de6afe022bd612a058c5deb59533ed9c260d7ec7

              • C:\Windows\System\svchost.exe

                Filesize

                65KB

                MD5

                b7eb82cce98c259f83df6848280d3f9e

                SHA1

                697c7c34ef977729dab50dc682c32a44466ede6a

                SHA256

                75f060ced9ef21a8da05d52a773ad8421b2c700910ddf2a00751335f783b235b

                SHA512

                47bd61db07f9cdc00a53ffc6f6a856c2cedda144279d45df3b0a33ad87c59abb928419db6a5ccef70b0b62ca4f62b9cd4e9c20364a3a7290c2dbc749a9e9c444

              • memory/2788-56-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2788-30-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2788-26-0x00000000754B0000-0x000000007560D000-memory.dmp

                Filesize

                1.4MB

              • memory/3192-14-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3192-18-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3192-13-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3192-71-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3192-60-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3192-15-0x00000000754B0000-0x000000007560D000-memory.dmp

                Filesize

                1.4MB

              • memory/3680-45-0x00000000754B0000-0x000000007560D000-memory.dmp

                Filesize

                1.4MB

              • memory/3680-51-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3764-57-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3764-58-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/3764-4-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/3764-3-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3764-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

                Filesize

                16KB

              • memory/3764-2-0x00000000754B0000-0x000000007560D000-memory.dmp

                Filesize

                1.4MB

              • memory/3764-0-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/4412-37-0x00000000754B0000-0x000000007560D000-memory.dmp

                Filesize

                1.4MB

              • memory/4412-42-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/4412-41-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/4412-62-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB