Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 13:09

General

  • Target

    de39c54c503bffd2d9dd6827d3b128a0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    de39c54c503bffd2d9dd6827d3b128a0

  • SHA1

    387d7dc4b773480cc33c4573019bd584f5581cc1

  • SHA256

    58db54e0af022ae3e759e7fbe74ceca33853f81ad09d6af4ecc231e6aa844681

  • SHA512

    3886ab4a2323500f59a52bdbb615389e4cd692933d2e5a0b7ae95323eed6de7060600d392a26cd36d7b01d1b90c25d7632107063d9b157b3835b9283180bee74

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiU:IeklMMYJhqezw/pXzH9iU

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de39c54c503bffd2d9dd6827d3b128a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\de39c54c503bffd2d9dd6827d3b128a0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2872
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2492
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2556
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2728
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2392
          • C:\Windows\SysWOW64\at.exe
            at 13:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1564
            • C:\Windows\SysWOW64\at.exe
              at 13:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2004
              • C:\Windows\SysWOW64\at.exe
                at 13:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:612

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          83201eb93e5217604f3e3fbb7ba38f02

          SHA1

          e761f2ef90e68a49e18eab3719fd8e63a46a5492

          SHA256

          f4ff6e5e7ceebd2660b8cf375fa32e07fa0b029c2fb61618e66d4e39d048e692

          SHA512

          befbae43aa78c1f59961b3025d8a3f842ee4a90c6f3103e2aa376220a0b6f592f23533b7c5b36bc75eabe154325514adaaba24bf3778ca783f228b9f2a8e139d

        • \Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          0dc58a0eece5a30d4f35a301f10b63ba

          SHA1

          e2f4df7c84d0b5db68faa262833afec56cf6eb8b

          SHA256

          90b664c594607be3c713323cb37c683b43b97fe8e7b06139ac5a7f1fb9f0ca0d

          SHA512

          0d80c6369263fc9cc19823aaf6a76783e7bfadfc687c6c131bfd1ae8a69010979e9d26af35d06ace93ba7bbde287755345ba7ff9d8ec02b2d8058ecdd6fbcdf4

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          526de2939fd4f65eb2278e3a65f49652

          SHA1

          afe9fa4ee2a92b3f23504ca70cc08ccdf82bbef9

          SHA256

          96da65dc0fa461714ea3aa81a4b9f71ef9dd70d88bced0282c01aced9ae13f6f

          SHA512

          9d6d11e5031dd372145d4e6c25f3b173bccb354800739a2ec424a3de72dce2ab9da38a19a0aba02958e16ad706f2649be001915c86dbc464f6a771a689b017a5

        • \Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          8e8ff15eff63b0d91a394365ea891517

          SHA1

          f3ce6f2c386747f71293a366e78d5c9767427c08

          SHA256

          4e72f4f99e4f6d6dbddb7ca281fbe36d48ec10d72b322c4490549793dfe7cf42

          SHA512

          8c764842f5c0dba7c43cfe18f9907b1f010ebc2715c1f6b7f52c6af56d851576e202cfa9f140221e31f3fcfa1cd9eae7a5140657b1d6fa7d7bb9c79986943623

        • memory/2392-72-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2392-66-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2492-20-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2492-18-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2492-91-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2492-34-0x00000000024C0000-0x00000000024F1000-memory.dmp

          Filesize

          196KB

        • memory/2492-80-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2556-76-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2556-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2556-36-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2556-37-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2556-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2728-54-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2728-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2728-63-0x0000000001D40000-0x0000000001D71000-memory.dmp

          Filesize

          196KB

        • memory/2728-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2728-82-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2872-65-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2872-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2872-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2872-77-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2872-78-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2872-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2872-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2872-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2872-16-0x0000000002BD0000-0x0000000002C01000-memory.dmp

          Filesize

          196KB