5d12d881e38424a579f1227935f8b679a347097f9e6e89223af7bb125c6bb6af

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
Size

66KB
MD5

1d813c40cf0babf5ddfd9951e2771b90
SHA1

e21c5e5f9fc02f885fe97d0c1e22590f7e41d6d1
SHA256

5d12d881e38424a579f1227935f8b679a347097f9e6e89223af7bb125c6bb6af
SHA512

129b64728341c9eed2026531cfe57d097928a38d02d9e7e343257c654fa504bd911d5161836da8e4a728e5190e40f96cebb062ae620b0e22f0a46836959dba01
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXim:IeklMMYJhqezw/pXzH9im

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2652-55-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1712	explorer.exe
2832	spoolsv.exe
2652	svchost.exe
2516	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
1712	explorer.exe
1712	explorer.exe
2832	spoolsv.exe
2832	spoolsv.exe
2652	svchost.exe
2652	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
2652	svchost.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe
1712	explorer.exe
2652	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1712	explorer.exe
2652	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
1712	explorer.exe
1712	explorer.exe
2832	spoolsv.exe
2832	spoolsv.exe
2652	svchost.exe
2652	svchost.exe
2516	spoolsv.exe
2516	spoolsv.exe
1712	explorer.exe
1712	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1712	2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe	28
PID 2412 wrote to memory of 1712	2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe	28
PID 2412 wrote to memory of 1712	2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe	28
PID 2412 wrote to memory of 1712	2412	1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2832	1712	explorer.exe	29
PID 1712 wrote to memory of 2832	1712	explorer.exe	29
PID 1712 wrote to memory of 2832	1712	explorer.exe	29
PID 1712 wrote to memory of 2832	1712	explorer.exe	29
PID 2832 wrote to memory of 2652	2832	spoolsv.exe	30
PID 2832 wrote to memory of 2652	2832	spoolsv.exe	30
PID 2832 wrote to memory of 2652	2832	spoolsv.exe	30
PID 2832 wrote to memory of 2652	2832	spoolsv.exe	30
PID 2652 wrote to memory of 2516	2652	svchost.exe	31
PID 2652 wrote to memory of 2516	2652	svchost.exe	31
PID 2652 wrote to memory of 2516	2652	svchost.exe	31
PID 2652 wrote to memory of 2516	2652	svchost.exe	31
PID 2652 wrote to memory of 2928	2652	svchost.exe	32
PID 2652 wrote to memory of 2928	2652	svchost.exe	32
PID 2652 wrote to memory of 2928	2652	svchost.exe	32
PID 2652 wrote to memory of 2928	2652	svchost.exe	32
PID 2652 wrote to memory of 1608	2652	svchost.exe	36
PID 2652 wrote to memory of 1608	2652	svchost.exe	36
PID 2652 wrote to memory of 1608	2652	svchost.exe	36
PID 2652 wrote to memory of 1608	2652	svchost.exe	36
PID 2652 wrote to memory of 2428	2652	svchost.exe	38
PID 2652 wrote to memory of 2428	2652	svchost.exe	38
PID 2652 wrote to memory of 2428	2652	svchost.exe	38
PID 2652 wrote to memory of 2428	2652	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1d813c40cf0babf5ddfd9951e2771b90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2928
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1608
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
b0d1bb214e9900921fe40a8acd3068c7

SHA1
eddd8e1290ab571eb1b33b1b33cd0d47e54f90ca

SHA256
d7413a2792329f9065942f48182761c313f5fe7f156836c4bc75c16006072b8a

SHA512
4f393f0ba9962f67362d4ea30030b6635cf42fa71fbd4560df51b907afeb976f2640ed811d74f74d8f3dda773a0f8f7485370802def04ff85b3343e468ed5fdd

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
098a5ee3f1f4c016aed15564126e15d4

SHA1
84311dad700fb347fe85c7b824a5ab7af1c98113

SHA256
9cc809497663f776e17d634e5d4d0737b4a2001be66732c5ec1eefc3a280d858

SHA512
a923ceb96f392c731436eb860eacf12423cdd3281a6a74f225f0a80c9d8b4570a7c056f28271dcee466ba96be610158e6ef4967c4ae449496fe3c24a60ef17e1

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
909691e9f93c8c2b30ae406f7a5d4af3

SHA1
aa96ad7fc986be2b1ac5b9c40074735d523616a7

SHA256
c513814ff614c775a54c526c449c7f7021b88a52bdf1c8e0b426071e743d12a0

SHA512
0468ebd39b2a6e6fff676d63851fda7c3719d98c9dcb2988e6f3f8c37be0dbd1992444edd3c165a3e5b94e5b3a43098c571e5257ebedfa5ac4eed9e53c3c5052

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
ef1f9335b3aefbd860fd46be125c75a6

SHA1
0c01ad64f3f0570ac88aeea09a3726951cba5b3d

SHA256
ad535fb75784349aa711056719faa3dbcba0fd1ef3b6c71c96f017c68727cb8c

SHA512
3a8ce3cb97204da43b8d03051bd41b1c6feab8e5e99f06aec5a124ae965d4af70e1ed6c2fdc36171c4e78760ea2057976ce994865200708619fd27e51d45246f

Download Submit
memory/1712-36-0x0000000000440000-0x0000000000471000-memory.dmp

Filesize
196KB

Download
memory/1712-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-35-0x0000000000440000-0x0000000000471000-memory.dmp

Filesize
196KB

Download
memory/1712-17-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2412-19-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/2412-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2412-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2412-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2412-20-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/2412-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2412-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-77-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2412-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2516-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2516-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2516-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2652-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2652-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2832-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2832-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2832-54-0x0000000001EF0000-0x0000000001F21000-memory.dmp

Filesize
196KB

Download
memory/2832-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2832-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download