f8a266fe5a32ad3ab72fb5010961ca86335a4d67ea0d8ce2abc812c7498777a1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
Size 66KB
Sample240526-vdp55aea47
SHA256 f8a266fe5a32ad3ab72fb5010961ca86335a4d67ea0d8ce2abc812c7498777a1
MD5 154fa8c9e1e726c6ab588f42e8051e90
SHA1 c7b24b1919267764736bdb29913c6d6cccc413af
SHA512 02f5eba16dd3b2ab0562ab2416bce0ae3dcdc3563c731a05abcd6d8ed4c03a02302b8db4e33f2e1ddc02c344c3345785021bb615ac80628e526a9b64886eb8e9
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXip:IeklMMYJhqezw/pXzH9ip
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/3152-36-0x0000000074ED0000-0x000000007502D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2360	explorer.exe
556	spoolsv.exe
3152	svchost.exe
4540	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2360	explorer.exe
2360	explorer.exe
2360	explorer.exe
2360	explorer.exe
2360	explorer.exe
2360	explorer.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe
3152	svchost.exe
3152	svchost.exe
2360	explorer.exe
2360	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2360	explorer.exe
3152	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
2360	explorer.exe
2360	explorer.exe
556	spoolsv.exe
556	spoolsv.exe
3152	svchost.exe
3152	svchost.exe
4540	spoolsv.exe
4540	spoolsv.exe
2360	explorer.exe
2360	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2360	2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	82
PID 2372 wrote to memory of 2360	2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	82
PID 2372 wrote to memory of 2360	2372	154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe	82
PID 2360 wrote to memory of 556	2360	explorer.exe	83
PID 2360 wrote to memory of 556	2360	explorer.exe	83
PID 2360 wrote to memory of 556	2360	explorer.exe	83
PID 556 wrote to memory of 3152	556	spoolsv.exe	84
PID 556 wrote to memory of 3152	556	spoolsv.exe	84
PID 556 wrote to memory of 3152	556	spoolsv.exe	84
PID 3152 wrote to memory of 4540	3152	svchost.exe	85
PID 3152 wrote to memory of 4540	3152	svchost.exe	85
PID 3152 wrote to memory of 4540	3152	svchost.exe	85
PID 3152 wrote to memory of 2540	3152	svchost.exe	86
PID 3152 wrote to memory of 2540	3152	svchost.exe	86
PID 3152 wrote to memory of 2540	3152	svchost.exe	86
PID 3152 wrote to memory of 2272	3152	svchost.exe	100
PID 3152 wrote to memory of 2272	3152	svchost.exe	100
PID 3152 wrote to memory of 2272	3152	svchost.exe	100
PID 3152 wrote to memory of 3944	3152	svchost.exe	111
PID 3152 wrote to memory of 3944	3152	svchost.exe	111
PID 3152 wrote to memory of 3944	3152	svchost.exe	111

C:\Users\Admin\AppData\Local\Temp\154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\154fa8c9e1e726c6ab588f42e8051e90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2360
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:556
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2540
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2272
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 5c630e52ff951f05e0fa2bff7f7c012faa4c7b6d7eea700888afb325d4e706fe
MD5 a64346f83b8494c5e91b208b3da9c1de
SHA1 ec4100d14207f8d8f042740355cbb78ef3c7d657
SHA512 7594d4339892b03775b8f22ad64afd9db815b1007f1812ab7daddce0b923b0cd40fe3ae06f90fa69cb9606cb3ac7b94c156ed6828ff58ebebed46f40d25f6850
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXia:IeklMMYJhqezw/pXzH9ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 ec88c921970f1920042efeefcfc36e9fa189c9bfc7785a9549e271caa7621d5f
MD5 32c187196fb1bbad35150540ee6dd7a9
SHA1 bbf221a246c915da1bccbe450195a060cb5588fc
SHA512 0a925c23c5a690650e9790e01c583b7f103fe67321b424355bfd28f11b1af7308dda34ba424c411b151e5d5346321168cc9ffda7180a733770391a88850fae75
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiv:IeklMMYJhqezw/pXzH9iv
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 5ad61381f336c126118f2f6acfe165154981cc556542e39602402a049f77c423
MD5 e90ce5ee89b2434f67ed822a4e823324
SHA1 88ce6853245226a8d67347c61d578fff7d30ac95
SHA512 0563a246bff31d852957a11b12a3238cbdebd210cb003e2e6cc00beea169615c348cdfaf992f1e090928f673aaddc59d431a023186fc294002726641e56a73f0
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXig:IeklMMYJhqezw/pXzH9ig
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 160b98d4b97e4ad75493ce25ea9b4892dcb6d7ce61a4ef4e5ad4100e7076c629
MD5 05850085e9ad59f67b394dcb09fe3946
SHA1 4c9dab007eca25e3d264d82b1bcaf6cc6c13e586
SHA512 7aa8b5ce44e3d699b7131d30ced4b15f1c4c8b55e212cea45ffea2ddc4c1257e1241b7a70849361029fe53b71c8efd17e47eb626de7d251cd5126f1c258c617c
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi2:IeklMMYJhqezw/pXzH9i2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/556-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/556-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/556-26-0x0000000074ED0000-0x000000007502D000-memory.dmp

Download

memory/2360-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2360-13-0x0000000074ED0000-0x000000007502D000-memory.dmp

Download

memory/2360-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2360-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2372-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2372-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2372-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2372-6-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2372-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/2372-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2372-2-0x0000000074ED0000-0x000000007502D000-memory.dmp

Download

memory/3152-40-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3152-36-0x0000000074ED0000-0x000000007502D000-memory.dmp

Download

memory/3152-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4540-43-0x0000000074ED0000-0x000000007502D000-memory.dmp

Download

memory/4540-46-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4540-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download