Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 13:09

General

  • Target

    de39c54c503bffd2d9dd6827d3b128a0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    de39c54c503bffd2d9dd6827d3b128a0

  • SHA1

    387d7dc4b773480cc33c4573019bd584f5581cc1

  • SHA256

    58db54e0af022ae3e759e7fbe74ceca33853f81ad09d6af4ecc231e6aa844681

  • SHA512

    3886ab4a2323500f59a52bdbb615389e4cd692933d2e5a0b7ae95323eed6de7060600d392a26cd36d7b01d1b90c25d7632107063d9b157b3835b9283180bee74

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiU:IeklMMYJhqezw/pXzH9iU

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de39c54c503bffd2d9dd6827d3b128a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\de39c54c503bffd2d9dd6827d3b128a0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3956
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1420
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2512
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4896
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1936
          • C:\Windows\SysWOW64\at.exe
            at 13:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1944
            • C:\Windows\SysWOW64\at.exe
              at 13:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2400
              • C:\Windows\SysWOW64\at.exe
                at 13:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:848

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          d405202312f8a11914f2e39d42ec2f15

          SHA1

          1dc6d4cac791a1f0dd65fc6c0600a0830db3d125

          SHA256

          ac5c4acce1d5f73a4581b2f808bf3487fec6050dea5c92a23c611d9c20b27af1

          SHA512

          274da7ec11622c06889b9beb940e1c4245d3753fe18fb9a77c1b145fa4f44973310657622ab3eaa6cd31c3f7123a7d0706eea34b77761f1fde52b5be472e92df

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          48d432e3bf4ab60a623168ea7d592bf5

          SHA1

          a585897d8f67cee0d2590b962b9fb0f0bfd44dc9

          SHA256

          aa51a55cddb8c3f777feeb2aef4ca92a3d758df50cfe516cee3d353b88a53f54

          SHA512

          c08cf54e23ae501b7b16c7acf97e23245ca7572b0f2f092927af83f97a38bae78a55684a9e8a76d4435b39cae2b01c19a1f197a1926b1c879c4670708a4987f1

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          74cd80c9ec33a0a3673a9cf4605d951f

          SHA1

          f998ce9b3a27057e9240e4db808a0f40be11d624

          SHA256

          15f5c9a24e84e78155fe91223f38ba02ea562328ca6e140cf96fec93321233d7

          SHA512

          b865de7c5233f14b9904992f66cb15f883c82e6bc16612948e4838f8816abd669286d417d63c92dea9ebf78c4c3603e209dcc3e165b94adbe4f7346b4074f2e7

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          6bc9b2beebaf611918edcd5b3541bc96

          SHA1

          8a0dfc9d52a6605dbc81bbf5d7fc318f7245ae29

          SHA256

          66d4ada375cfbc5f8e9bd489858c48f7816bffb9af8e8b6b2a019ab7f7db31a9

          SHA512

          1f0c2e42f906b329822b6d46a20518565d770dadf6968de602c8e478fefdda03cee5d5e8e0f1a20c4ea007d3e781bb73352f22fa0a6b41ba550dd7f4f446fdb9

        • memory/1420-14-0x0000000074F20000-0x000000007507D000-memory.dmp

          Filesize

          1.4MB

        • memory/1420-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1420-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1420-61-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1420-12-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1936-46-0x0000000074F20000-0x000000007507D000-memory.dmp

          Filesize

          1.4MB

        • memory/1936-52-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-27-0x0000000074F20000-0x000000007507D000-memory.dmp

          Filesize

          1.4MB

        • memory/2512-26-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-25-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-31-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2512-56-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3956-58-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/3956-5-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/3956-59-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/3956-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3956-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3956-2-0x0000000074F20000-0x000000007507D000-memory.dmp

          Filesize

          1.4MB

        • memory/3956-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/3956-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4896-38-0x0000000074F20000-0x000000007507D000-memory.dmp

          Filesize

          1.4MB

        • memory/4896-43-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4896-44-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4896-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB