Overview

overview

10

Static

static

3

1beb685ee1...cs.exe

windows7-x64

10

1beb685ee1...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1beb685ee1bcabdf6aae564bd8335340_NeikiAnalytics.exe

  • Size

    66KB

  • Sample

    240527-dp1ybsfb79

  • MD5

    1beb685ee1bcabdf6aae564bd8335340

  • SHA1

    84aaae784ddf7bc38d81eb3e9e495f31d5b7c927

  • SHA256

    72f3bac214fa0343f160541d77f445a4615f8b02da32daa0dba81344f01708b8

  • SHA512

    c431ca9d1128f2fecf8f769c5ef5e24c8b95b6807b9287562b9f1820616de8447c98f152a2a57556a9164b202dcda1491d6a9aef062954f5ca0e9dc78130d8fc

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi1:IeklMMYJhqezw/pXzH9i1

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      1beb685ee1bcabdf6aae564bd8335340_NeikiAnalytics.exe

    • Size

      66KB

    • MD5

      1beb685ee1bcabdf6aae564bd8335340

    • SHA1

      84aaae784ddf7bc38d81eb3e9e495f31d5b7c927

    • SHA256

      72f3bac214fa0343f160541d77f445a4615f8b02da32daa0dba81344f01708b8

    • SHA512

      c431ca9d1128f2fecf8f769c5ef5e24c8b95b6807b9287562b9f1820616de8447c98f152a2a57556a9164b202dcda1491d6a9aef062954f5ca0e9dc78130d8fc

    • SSDEEP

      1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi1:IeklMMYJhqezw/pXzH9i1

    Score
    10/10
    evasionpersistencetrojan

    • Detects BazaLoader malware

      BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

      trojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks