3ba914be4088c48a219d60fc31e5a2c4de178d1c1d61069cd7539c505419b775

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
Size

66KB
MD5

3cf8fa2d7bb0b94002dacfd153433e70
SHA1

77a99bb9c2c0ed47cb9e7a331c007cc06b6caee4
SHA256

3ba914be4088c48a219d60fc31e5a2c4de178d1c1d61069cd7539c505419b775
SHA512

d4e91c5f359661607827b18444c14627a86388fa4f47cbdc8ff9acd3a58493a988851ac6d0c209c5e5c5f53aa7166a445be7367aa7f254ed52d16b5a69f1f0a7
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXin:IeklMMYJhqezw/pXzH9in

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/3452-37-0x0000000075AC0000-0x0000000075C1D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2928	explorer.exe
4536	spoolsv.exe
3452	svchost.exe
5076	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
2928	explorer.exe
2928	explorer.exe
2928	explorer.exe
2928	explorer.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe
2928	explorer.exe
2928	explorer.exe
3452	svchost.exe
3452	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2928	explorer.exe
3452	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
2928	explorer.exe
2928	explorer.exe
4536	spoolsv.exe
4536	spoolsv.exe
3452	svchost.exe
3452	svchost.exe
5076	spoolsv.exe
5076	spoolsv.exe
2928	explorer.exe
2928	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2928	1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	81
PID 1544 wrote to memory of 2928	1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	81
PID 1544 wrote to memory of 2928	1544	3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe	81
PID 2928 wrote to memory of 4536	2928	explorer.exe	82
PID 2928 wrote to memory of 4536	2928	explorer.exe	82
PID 2928 wrote to memory of 4536	2928	explorer.exe	82
PID 4536 wrote to memory of 3452	4536	spoolsv.exe	83
PID 4536 wrote to memory of 3452	4536	spoolsv.exe	83
PID 4536 wrote to memory of 3452	4536	spoolsv.exe	83
PID 3452 wrote to memory of 5076	3452	svchost.exe	84
PID 3452 wrote to memory of 5076	3452	svchost.exe	84
PID 3452 wrote to memory of 5076	3452	svchost.exe	84
PID 3452 wrote to memory of 5064	3452	svchost.exe	86
PID 3452 wrote to memory of 5064	3452	svchost.exe	86
PID 3452 wrote to memory of 5064	3452	svchost.exe	86
PID 3452 wrote to memory of 2812	3452	svchost.exe	98
PID 3452 wrote to memory of 2812	3452	svchost.exe	98
PID 3452 wrote to memory of 2812	3452	svchost.exe	98
PID 3452 wrote to memory of 64	3452	svchost.exe	100
PID 3452 wrote to memory of 64	3452	svchost.exe	100
PID 3452 wrote to memory of 64	3452	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3cf8fa2d7bb0b94002dacfd153433e70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
a4ceb64921e9962e9609445689272e2f

SHA1
2995dfa5ca7f35a83a8d66ebb6906d6a2219d5a8

SHA256
12a3121a3b500c72eca391c3d72faca7c11ad230f5ea4b67c9187b07154fa21c

SHA512
530d6c2f040209e868d7fa390b245a19201a6a4e5b1fe767e22e668abb4a70fb7ff16fb55a67383dfd8fab7264b42c0318552caecc88a3f6c1e96b63bb3dde6f

Download Submit
C:\Windows\System\explorer.exe

Filesize
66KB

MD5
116aca6826849510930e9d86c1548e20

SHA1
300bdea63a8d7a57f67d6bf512ddcce2e05368c2

SHA256
44d77e2ab9a564fccd458b7fbf38f1da014cac1802ca718badd288b48bb9a546

SHA512
f6b51b29e9510194f7aeec225cda343450c196a6853e7bed37613db0d064b94e9b5c738948eb9147c5b002dda22663c2f6e93f080806846d3d2828e92b2efb23

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
659aa7d7025ecd833b234c98d4e42f06

SHA1
033de07b7b836f2adc009e986889cb9776ea883a

SHA256
744a7967bcac27eb9ed5129f910952fcde2892feb8b6677d9c8390099584ca57

SHA512
5a7ee6c16d76ce5687b1fcf401b2ecef16e2e685563028edbda8d6776c90b4d08a735bc2282953ff076f655ce2593eb87a4d2db8a1b23518432785b3fbc6c781

Download Submit
C:\Windows\System\svchost.exe

Filesize
66KB

MD5
4107204884cceb59adc30c8c2fd4facf

SHA1
bbb78f1e0c6ad39d7ed45c0d5c781be350e92714

SHA256
30a48d7b6cc19c81587dd70e64f920095b03e32d0ce75c545a9de506271ce78b

SHA512
a7c45e6f27b8fe26d4d2e1da14c413f1611ebe5cf1b9fdbc8d0475dbe7c682a44e86e2ae6e41c92b80b03a0b508bed99bb716f7f74e5c5cd23b2cf78d823b5a5

Download Submit
memory/1544-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1544-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1544-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1544-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1544-2-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/1544-57-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1544-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-14-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/2928-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2928-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3452-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3452-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3452-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3452-37-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/4536-31-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4536-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4536-26-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/4536-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5076-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5076-46-0x0000000075AC0000-0x0000000075C1D000-memory.dmp

Filesize
1.4MB

Download
memory/5076-45-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download