f8a266fe5a32ad3ab72fb5010961ca86335a4d67ea0d8ce2abc812c7498777a1

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
Size

66KB
MD5

154fa8c9e1e726c6ab588f42e8051e90
SHA1

c7b24b1919267764736bdb29913c6d6cccc413af
SHA256

f8a266fe5a32ad3ab72fb5010961ca86335a4d67ea0d8ce2abc812c7498777a1
SHA512

02f5eba16dd3b2ab0562ab2416bce0ae3dcdc3563c731a05abcd6d8ed4c03a02302b8db4e33f2e1ddc02c344c3345785021bb615ac80628e526a9b64886eb8e9
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2528-54-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2056	explorer.exe
2604	spoolsv.exe
2528	svchost.exe
2692	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2056	explorer.exe
2056	explorer.exe
2604	spoolsv.exe
2604	spoolsv.exe
2528	svchost.exe
2528	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe
2528	svchost.exe
2056	explorer.exe
2528	svchost.exe
2528	svchost.exe
2056	explorer.exe
2056	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2056	explorer.exe
2528	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2056	explorer.exe
2056	explorer.exe
2604	spoolsv.exe
2604	spoolsv.exe
2528	svchost.exe
2528	svchost.exe
2692	spoolsv.exe
2692	spoolsv.exe
2056	explorer.exe
2056	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2056	2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	28
PID 2128 wrote to memory of 2056	2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	28
PID 2128 wrote to memory of 2056	2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	28
PID 2128 wrote to memory of 2056	2128	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	28
PID 2056 wrote to memory of 2604	2056	explorer.exe	29
PID 2056 wrote to memory of 2604	2056	explorer.exe	29
PID 2056 wrote to memory of 2604	2056	explorer.exe	29
PID 2056 wrote to memory of 2604	2056	explorer.exe	29
PID 2604 wrote to memory of 2528	2604	spoolsv.exe	30
PID 2604 wrote to memory of 2528	2604	spoolsv.exe	30
PID 2604 wrote to memory of 2528	2604	spoolsv.exe	30
PID 2604 wrote to memory of 2528	2604	spoolsv.exe	30
PID 2528 wrote to memory of 2692	2528	svchost.exe	31
PID 2528 wrote to memory of 2692	2528	svchost.exe	31
PID 2528 wrote to memory of 2692	2528	svchost.exe	31
PID 2528 wrote to memory of 2692	2528	svchost.exe	31
PID 2528 wrote to memory of 2932	2528	svchost.exe	32
PID 2528 wrote to memory of 2932	2528	svchost.exe	32
PID 2528 wrote to memory of 2932	2528	svchost.exe	32
PID 2528 wrote to memory of 2932	2528	svchost.exe	32
PID 2528 wrote to memory of 1252	2528	svchost.exe	36
PID 2528 wrote to memory of 1252	2528	svchost.exe	36
PID 2528 wrote to memory of 1252	2528	svchost.exe	36
PID 2528 wrote to memory of 1252	2528	svchost.exe	36
PID 2528 wrote to memory of 1948	2528	svchost.exe	38
PID 2528 wrote to memory of 1948	2528	svchost.exe	38
PID 2528 wrote to memory of 1948	2528	svchost.exe	38
PID 2528 wrote to memory of 1948	2528	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2056
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1252
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
6ad40b76907eb6190de07876ea3ab546

SHA1
8364da9b01e2d947edd740c9bc6ae56bba6b6256

SHA256
68380e38956ed194185fde9d02c8ef92b6f79556996bf63836f86bf628daeeba

SHA512
6c4ce68827a13f493ac875d425a072c9bee3f0be1ff34090a6f337cf05bef86f9e14f090e2f106d265772740096c304eea0dff0d92f5e9c7e1e38a33c3275512

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
5e4c3538435e01bb4ef77e18623de615

SHA1
aee84c2a4624540b3b4efd11087f426fb04a7872

SHA256
efef0fac542163a5883e5271f7c464c1e8e4da1c8ea955d8f7d80ccf5b9a0516

SHA512
ba1007c7437065bf1b379b07a4ae6db9fdd82f0dba98df869a6ca50a6dd96923a6feca33442c1eaba263be5ea807ff4a808a24f438f6350d1563a58be45c9101

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
2cbf5510ff126f6db70881a7cec0737d

SHA1
8b20a596f25b0d4a5dc2c2309f2570b5a81e06f3

SHA256
7d4404821ae7b2a1fade65c7cd7885e0eb6a0a640375c2b39891a5b8134d7578

SHA512
88ad825c8e2dbfc5311dfbb4037c1e4f50fb0a06513e405df5500524d7056cf991283a6128d5b8eb98f09636a262e07f4208bad2bc53b2ad785d4ab3906283bc

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
46e4898798067b58f4b1b51a29a4741f

SHA1
26ff7051aef3e68451686ef8d3829d9b75d64234

SHA256
ccaddbbd91ba6496d5e225a78212caf055260994d7b219cbc3e5003f2a88c97d

SHA512
9c2c6bc78cce01f74c4022387dee7190bbb5d8fa78826de6a102464db5c63ca06a71623c0671b66555f013d241e2a45964229a34f746cadb3c439a349813156f

Download Submit
memory/2056-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2056-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2056-36-0x0000000002680000-0x00000000026B1000-memory.dmp

Filesize
196KB

Download
memory/2056-37-0x0000000002680000-0x00000000026B1000-memory.dmp

Filesize
196KB

Download
memory/2128-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2128-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2128-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2128-17-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Filesize
196KB

Download
memory/2128-65-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2128-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2128-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2128-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2128-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2528-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2528-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2528-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2528-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2604-58-0x0000000002650000-0x0000000002681000-memory.dmp

Filesize
196KB

Download
memory/2604-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2604-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2604-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2692-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2692-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download