3ba914be4088c48a219d60fc31e5a2c4de178d1c1d61069cd7539c505419b775

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
Size

66KB
MD5

3cf8fa2d7bb0b94002dacfd153433e70
SHA1

77a99bb9c2c0ed47cb9e7a331c007cc06b6caee4
SHA256

3ba914be4088c48a219d60fc31e5a2c4de178d1c1d61069cd7539c505419b775
SHA512

d4e91c5f359661607827b18444c14627a86388fa4f47cbdc8ff9acd3a58493a988851ac6d0c209c5e5c5f53aa7166a445be7367aa7f254ed52d16b5a69f1f0a7
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXin:IeklMMYJhqezw/pXzH9in

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2616-56-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2556	explorer.exe
2644	spoolsv.exe
2616	svchost.exe
2444	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
2556	explorer.exe
2556	explorer.exe
2644	spoolsv.exe
2644	spoolsv.exe
2616	svchost.exe
2616	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2556	explorer.exe
2616	svchost.exe
2616	svchost.exe
2556	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2556	explorer.exe
2616	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
2556	explorer.exe
2556	explorer.exe
2644	spoolsv.exe
2644	spoolsv.exe
2616	svchost.exe
2616	svchost.exe
2444	spoolsv.exe
2444	spoolsv.exe
2556	explorer.exe
2556	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2556	3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	28
PID 3008 wrote to memory of 2556	3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	28
PID 3008 wrote to memory of 2556	3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	28
PID 3008 wrote to memory of 2556	3008	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	28
PID 2556 wrote to memory of 2644	2556	explorer.exe	29
PID 2556 wrote to memory of 2644	2556	explorer.exe	29
PID 2556 wrote to memory of 2644	2556	explorer.exe	29
PID 2556 wrote to memory of 2644	2556	explorer.exe	29
PID 2644 wrote to memory of 2616	2644	spoolsv.exe	30
PID 2644 wrote to memory of 2616	2644	spoolsv.exe	30
PID 2644 wrote to memory of 2616	2644	spoolsv.exe	30
PID 2644 wrote to memory of 2616	2644	spoolsv.exe	30
PID 2616 wrote to memory of 2444	2616	svchost.exe	31
PID 2616 wrote to memory of 2444	2616	svchost.exe	31
PID 2616 wrote to memory of 2444	2616	svchost.exe	31
PID 2616 wrote to memory of 2444	2616	svchost.exe	31
PID 2616 wrote to memory of 2396	2616	svchost.exe	32
PID 2616 wrote to memory of 2396	2616	svchost.exe	32
PID 2616 wrote to memory of 2396	2616	svchost.exe	32
PID 2616 wrote to memory of 2396	2616	svchost.exe	32
PID 2616 wrote to memory of 1052	2616	svchost.exe	36
PID 2616 wrote to memory of 1052	2616	svchost.exe	36
PID 2616 wrote to memory of 1052	2616	svchost.exe	36
PID 2616 wrote to memory of 1052	2616	svchost.exe	36
PID 2616 wrote to memory of 3028	2616	svchost.exe	38
PID 2616 wrote to memory of 3028	2616	svchost.exe	38
PID 2616 wrote to memory of 3028	2616	svchost.exe	38
PID 2616 wrote to memory of 3028	2616	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2396
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1052
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
f5483d876fec5468e36ceb4c62441697

SHA1
86407d3737ba85c9b2bb60427efb2d858b06de62

SHA256
025f6da0cf7e9aabdbae77354e90e23e32e4893d1e6c99cdbae6c03c305ca4b0

SHA512
37d48c73b34ec9409e61c93a01fe1b50fbc3a2778e4ded24aa24ab154ebbf4fc2f56ebcc4e6a5b788f4d0cb3a85b25c95092c4251cb83258e4126dcca5561f0e

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
7004c0722137a2e29c7425876571dcb0

SHA1
4477439e8637de6a0bed30e0d25962412dc38b46

SHA256
a27a8ae70d73346269c10da9b606b7bf78a0d9499c0bbe9af3f4bd84c89370c5

SHA512
754d548fa608fee27beaf0b1119646f2b27c490f8b9548dc7c1be206199aeada76c192cc8fb0d4539a6394520c4a3ad3e6b43375867ad0232e61e216f8daf05e

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
14dd11b6f8e888afc177474eae343253

SHA1
72fa565adfc3b72c01ef4d97e62b328401b9b299

SHA256
b444692db3ee12353feff3d59eed7e34ea56f4effee62d2fa9e16d062396afb0

SHA512
3576d73d053b410a8b9fca34ae138f47d08981f5407b70489e65fd583f7cd57f449176c92e0de81acf9f94bb455f12ab183c8e08d2d5cb1503de64b381895f05

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
a94b5abd5194614c6beab980ec773375

SHA1
18d1eafa92035fe95e595e9734a65cc9e4ab3b39

SHA256
3300921b37c2d3787b0571c966147d5e127a8aef894aba1d51bc0d51f242159e

SHA512
d7abe758ee85b498386b26710b0592d42ceaf39422442a9307895f4806490407f77387448e04ae9bfa2c65a1be060312368fbbd1e3aec21a3fe726ebafb3bcf0

Download Submit
memory/2444-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2444-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2556-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-35-0x0000000000590000-0x00000000005C1000-memory.dmp

Filesize
196KB

Download
memory/2556-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-91-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2616-65-0x00000000003C0000-0x00000000003F1000-memory.dmp

Filesize
196KB

Download
memory/2616-64-0x00000000003C0000-0x00000000003F1000-memory.dmp

Filesize
196KB

Download
memory/2616-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2644-53-0x0000000002A60000-0x0000000002A91000-memory.dmp

Filesize
196KB

Download
memory/2644-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2644-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2644-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2644-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3008-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3008-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3008-52-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3008-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3008-17-0x0000000000550000-0x0000000000581000-memory.dmp

Filesize
196KB

Download
memory/3008-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3008-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3008-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3008-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download