97a58b7e74c8d02c069641522b17eff992a6c83e1edf915ce10a1316cac42b54

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
Size 66KB
Sample240527-3xeshaef9t
SHA256 97a58b7e74c8d02c069641522b17eff992a6c83e1edf915ce10a1316cac42b54
MD5 27e6f726c67b2d38878c9ab30421ee40
SHA1 de0a1768868e12dc8c84dfa94ee4fea5b3a448c2
SHA512 29b43f6ae9ce0cdf567cebf6f2d7b126d1558f1b4e506d04a30cc1f83f0ead1abb259185847ff54abb164c4ba3dc1a856108214d2f7980fe5a16e78bbaaba2eb
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiB:IeklMMYJhqezw/pXzH9iB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/4136-35-0x00000000758B0000-0x0000000075A0D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2872	explorer.exe
1588	spoolsv.exe
4136	svchost.exe
4172	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe
2872	explorer.exe
2872	explorer.exe
4136	svchost.exe
4136	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2872	explorer.exe
4136	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
2872	explorer.exe
2872	explorer.exe
1588	spoolsv.exe
1588	spoolsv.exe
4136	svchost.exe
4136	svchost.exe
4172	spoolsv.exe
4172	spoolsv.exe
2872	explorer.exe
2872	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 2872	4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe	84
PID 4160 wrote to memory of 2872	4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe	84
PID 4160 wrote to memory of 2872	4160	27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe	84
PID 2872 wrote to memory of 1588	2872	explorer.exe	85
PID 2872 wrote to memory of 1588	2872	explorer.exe	85
PID 2872 wrote to memory of 1588	2872	explorer.exe	85
PID 1588 wrote to memory of 4136	1588	spoolsv.exe	86
PID 1588 wrote to memory of 4136	1588	spoolsv.exe	86
PID 1588 wrote to memory of 4136	1588	spoolsv.exe	86
PID 4136 wrote to memory of 4172	4136	svchost.exe	87
PID 4136 wrote to memory of 4172	4136	svchost.exe	87
PID 4136 wrote to memory of 4172	4136	svchost.exe	87
PID 4136 wrote to memory of 916	4136	svchost.exe	88
PID 4136 wrote to memory of 916	4136	svchost.exe	88
PID 4136 wrote to memory of 916	4136	svchost.exe	88
PID 4136 wrote to memory of 2388	4136	svchost.exe	104
PID 4136 wrote to memory of 2388	4136	svchost.exe	104
PID 4136 wrote to memory of 2388	4136	svchost.exe	104
PID 4136 wrote to memory of 952	4136	svchost.exe	113
PID 4136 wrote to memory of 952	4136	svchost.exe	113
PID 4136 wrote to memory of 952	4136	svchost.exe	113

C:\Users\Admin\AppData\Local\Temp\27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\27e6f726c67b2d38878c9ab30421ee40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:916
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 2a1caa97c92eaf57b26de1db71f7fd6c1396b013e93be99935fcfe5830cd47e3
MD5 5d30236a2574d0bdf090a18a42ad597e
SHA1 a76c4240ad8213237f0983954fa3961cb77008e5
SHA512 fe3e6940fe3ed82364cc6e558227aec2a4fcaeb68b431b42a8893d3a0588d5b501081874b244034fa0cc349f1a4ce67323386e8c125c9cfe66e21111021f2cbd
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXif:IeklMMYJhqezw/pXzH9if
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 846e4b70d3ea2b1c88637bc8f60400fb52fa0abe841bf8e45ad8cd6682023c43
MD5 969a46fec143202e023fabd52637c9bc
SHA1 8d7c7f73c6db4468b6ea307519de971f7b01197d
SHA512 9f793cf96aa8e121a966760d19d9135efa3b6da3c3b5293625e693bd9b3c37f3edf2c9a96af0693a9191c41c2c5badffb0ac8b61afdb0bbf003450f8226dc2f4
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXio:IeklMMYJhqezw/pXzH9io
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 80a6289f5f86afdac137cbdd6fa1dc41147bd33115f6b58b0b5dd883902112b8
MD5 4418804b5d0bc32725242d2bb8a82508
SHA1 5ab792a4dff0fc436a5da1d89a6889d482e8d2d7
SHA512 23c8cf0ae2344651e9af16e7224265eb560596d2712473a62bf52ad0d81efbd8f7e9f5442b96df54c1c0219861d3d3a88835e8637003bcd56039e8e7d620a4d0
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi7:IeklMMYJhqezw/pXzH9i7
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 57a88d1ddb89720a84d9fd598d6965c4beb9d60414dd6a98a828b9469fe0b295
MD5 a2f1a2362af7f5a363a3ccfe31ed5300
SHA1 28d407f92891744a9c1afcec97bbcbbbff488205
SHA512 ebd9de0606ff85d1a88f9e5d163866b4296df157694af4db33c1ba94414f555e9c9d07408b51054b05273b00fd3663ab00311fba2e9b5f1fede349ffdd8e2c8a
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiJ:IeklMMYJhqezw/pXzH9iJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1588-25-0x00000000758B0000-0x0000000075A0D000-memory.dmp

Download

memory/1588-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1588-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2872-13-0x00000000758B0000-0x0000000075A0D000-memory.dmp

Download

memory/2872-67-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2872-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2872-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4136-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4136-35-0x00000000758B0000-0x0000000075A0D000-memory.dmp

Download

memory/4160-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4160-53-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4160-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4160-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4160-56-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4160-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4160-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4160-2-0x00000000758B0000-0x0000000075A0D000-memory.dmp

Download

memory/4172-49-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4172-41-0x00000000758B0000-0x0000000075A0D000-memory.dmp

Download