Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:24

General

  • Target

    5af5800767fdad8ab5a0828193493180_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    5af5800767fdad8ab5a0828193493180

  • SHA1

    b295945b2ec3b280cda31b726e5505024cae9a77

  • SHA256

    758bbc9096cb3457ef3d5b5edf66e1644875abb9dfc1b5b296f4796226cdd751

  • SHA512

    a2ea3b3adb058eac958432e223f383d1fe46a468d23e1a3f28fae905eabc15c0bee5ed3f1ff6fa6a85b9227d9166d7130a4a003bf98504a444c64642f346a4ac

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5af5800767fdad8ab5a0828193493180_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5af5800767fdad8ab5a0828193493180_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1312
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2640
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2600
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2388
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2444
          • C:\Windows\SysWOW64\at.exe
            at 03:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1444
            • C:\Windows\SysWOW64\at.exe
              at 03:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2284
              • C:\Windows\SysWOW64\at.exe
                at 03:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2424

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                66KB

                MD5

                3a97d677a2f3c44ace9c061a350d0d06

                SHA1

                c6af582cf6c2c8115da11cc530aaa2dcde666497

                SHA256

                4a2cdaa6cf0ddb6ee869de4ade9cca139078b2e65a52e3613147b7beddb6f42c

                SHA512

                882ab0e82d76c40bac1d39a25cc514ddf230634ab6b73bb75d9c3f7e3d314f9cadece3ab1e80f146c989d26becca225e426cc3f3b16220061866346c1e7e1916

              • C:\Windows\system\svchost.exe

                Filesize

                66KB

                MD5

                8ac71da89956bf98916452a872c398a5

                SHA1

                305af6ad4463345ddf75ccf3a964e39f3a4be9e6

                SHA256

                066ee427677b4763b8bfee336a2baa26464e9d31e7619237451151702759d992

                SHA512

                a33967a0de627a17c85815775d3bca631470fbb8164e7222445e88420bd8a1a8af2374da9984b2035b8b7f2b0b448a4b3efbb54bfe299d9a418d96a257b62c6b

              • \Windows\system\explorer.exe

                Filesize

                66KB

                MD5

                212038753ac5bce5e19fa278448ff2e6

                SHA1

                238a2a08a849982c6af6e7740dda0c9d35366581

                SHA256

                880944fb51ececd983d10aab5674a555b13bce2db90cf1404185f3147094df35

                SHA512

                94dd9c1e70e24f75743cda2babcea3c4d7e87e27363562474d53bcc74a49d55e4429d3e5781415df3b76d4ffc01bf64f79409c2ed140e6bfe31476ebcced4edf

              • \Windows\system\spoolsv.exe

                Filesize

                66KB

                MD5

                523b8f39f0cf85c0335ca9e7b2a50c71

                SHA1

                ed0f15ccbf01762100323856fa6cb2f89becfd47

                SHA256

                cafea76e2c9edd3ba4d9348b4adfac5dab357b2416566f5e5380c35420fbc253

                SHA512

                17d169730d8f495ff63d5a5af8982aea9a4cdf784655cd92f2d0388f5ab3d6fed2d123e66e831ba4b405d10cf8cb8a969b8a0cc08275953ca7aff640fddc24ec

              • memory/1312-1-0x0000000000020000-0x0000000000024000-memory.dmp

                Filesize

                16KB

              • memory/1312-81-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1312-17-0x0000000002C40000-0x0000000002C71000-memory.dmp

                Filesize

                196KB

              • memory/1312-64-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1312-3-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1312-0-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1312-2-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/1312-6-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1312-80-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2388-53-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2388-66-0x0000000002580000-0x00000000025B1000-memory.dmp

                Filesize

                196KB

              • memory/2388-57-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2388-59-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2388-85-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2388-65-0x0000000002580000-0x00000000025B1000-memory.dmp

                Filesize

                196KB

              • memory/2444-74-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2444-67-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2444-68-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2600-52-0x0000000002640000-0x0000000002671000-memory.dmp

                Filesize

                196KB

              • memory/2600-40-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2600-36-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2600-78-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2640-35-0x00000000025E0000-0x0000000002611000-memory.dmp

                Filesize

                196KB

              • memory/2640-23-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2640-83-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2640-19-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2640-94-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2640-18-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB