Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:24

General

  • Target

    5af5800767fdad8ab5a0828193493180_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    5af5800767fdad8ab5a0828193493180

  • SHA1

    b295945b2ec3b280cda31b726e5505024cae9a77

  • SHA256

    758bbc9096cb3457ef3d5b5edf66e1644875abb9dfc1b5b296f4796226cdd751

  • SHA512

    a2ea3b3adb058eac958432e223f383d1fe46a468d23e1a3f28fae905eabc15c0bee5ed3f1ff6fa6a85b9227d9166d7130a4a003bf98504a444c64642f346a4ac

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5af5800767fdad8ab5a0828193493180_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5af5800767fdad8ab5a0828193493180_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:744
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:372
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3772
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3928
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2456
          • C:\Windows\SysWOW64\at.exe
            at 03:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:4924
            • C:\Windows\SysWOW64\at.exe
              at 03:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:4232
              • C:\Windows\SysWOW64\at.exe
                at 03:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1496

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                66KB

                MD5

                b5fdfa0322ba70a9a2ce2546e0619932

                SHA1

                66a61d606e08a2851d8c1b23ef421731f9b6f351

                SHA256

                e67e002ccf588b500f2e3bab3cc49a4f310043d9b5449d283ccead4db450585b

                SHA512

                7a37eccefdc8bf23ec3d9d4522cd8b5f4491a6f8754138b72ef56df0f6ae33a8c065cd2d7e397395385a58ad69fc6aa35fb82b98a82ead187b9823681c24e8a2

              • C:\Windows\System\spoolsv.exe

                Filesize

                66KB

                MD5

                5a1b544f2130b87f4e1282f201616434

                SHA1

                f7a577780e9de834f9d94f3881acec9c0a835189

                SHA256

                b4cbe98cf3175fb7a22394814887e2c9f26a6e12f00ec834f659c0a9c63e2628

                SHA512

                cda8468a8b0f3c86cf7d7186c9dd9fae0123e748b6329c42383abe6f286e08d0a0b2d153a085b46540cff329c0ccd83555b078cbabbbdaf4ff0b161d0d10173d

              • C:\Windows\System\svchost.exe

                Filesize

                66KB

                MD5

                52d318c44b01635dffac492850dd7678

                SHA1

                8ce6c5a956005a57e88b696e5cdf6fe1e1e51fb6

                SHA256

                e0eb91505325cd0630bcbcee976567dc87f175c447b414badf60506381e7db76

                SHA512

                744361d1a33e025d2236edc25a92a393f2a33b42ba87e2f002392395a12d83ead9816628a7cd810e0d9df918f6ceaed84d9c9ab99dd79d9e32779fabe048d913

              • \??\c:\windows\system\explorer.exe

                Filesize

                66KB

                MD5

                e9ebeeae8b9ebb686d876b96181e3be4

                SHA1

                0047c0b2f52bd272856ab568f98a2731ef61da70

                SHA256

                01026b44620f2aab629f0c64be58baa2e4b1efe58d3dc8ce1620abfa72f2e19d

                SHA512

                864e3211d6e794f9441992e4ea7823ad09fc041ea3adcecb34c87d4d4739a1e1d5b5b74fe0164fe97ebc8902cf594f8be87bcdd923e59fb659c76e11ecf65925

              • memory/372-22-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/372-57-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/372-14-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/372-13-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/372-15-0x0000000075700000-0x000000007585D000-memory.dmp

                Filesize

                1.4MB

              • memory/372-68-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/744-2-0x0000000075700000-0x000000007585D000-memory.dmp

                Filesize

                1.4MB

              • memory/744-55-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/744-0-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/744-4-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/744-3-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/744-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

                Filesize

                16KB

              • memory/744-54-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2456-43-0x0000000075700000-0x000000007585D000-memory.dmp

                Filesize

                1.4MB

              • memory/2456-49-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3772-53-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3772-28-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3772-26-0x0000000075700000-0x000000007585D000-memory.dmp

                Filesize

                1.4MB

              • memory/3928-59-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/3928-37-0x0000000075700000-0x000000007585D000-memory.dmp

                Filesize

                1.4MB