22c9bde5692a6e43086793179828c1135084739982e8347ef5ded42d4af07cd3

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
Size 66KB
Sample240601-he25vsch7s
SHA256 22c9bde5692a6e43086793179828c1135084739982e8347ef5ded42d4af07cd3
MD5 911f5ad32b4413f552e617ac84bb07e0
SHA1 6ba1907aac5a47c54ef0f5dea48ef5f8cb01ece9
SHA512 63753e60db89fa18bce0ebcce4bc093a27fb3ab7871a1d12df696c9cb075b2c83c49a362506753f28e503ab302690e1d7f8411b6d7fab9207f566b9ce6133987
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXix:IeklMMYJhqezw/pXzH9ix
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2492-54-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2424	explorer.exe
2616	spoolsv.exe
2492	svchost.exe
2480	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
2424	explorer.exe
2424	explorer.exe
2616	spoolsv.exe
2616	spoolsv.exe
2492	svchost.exe
2492	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
2424	explorer.exe
2424	explorer.exe
2424	explorer.exe
2424	explorer.exe
2492	svchost.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe
2492	svchost.exe
2424	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2424	explorer.exe
2492	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
2424	explorer.exe
2424	explorer.exe
2616	spoolsv.exe
2616	spoolsv.exe
2492	svchost.exe
2492	svchost.exe
2480	spoolsv.exe
2480	spoolsv.exe
2424	explorer.exe
2424	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2424	2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 2424	2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 2424	2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 2424	2104	911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe	28
PID 2424 wrote to memory of 2616	2424	explorer.exe	29
PID 2424 wrote to memory of 2616	2424	explorer.exe	29
PID 2424 wrote to memory of 2616	2424	explorer.exe	29
PID 2424 wrote to memory of 2616	2424	explorer.exe	29
PID 2616 wrote to memory of 2492	2616	spoolsv.exe	30
PID 2616 wrote to memory of 2492	2616	spoolsv.exe	30
PID 2616 wrote to memory of 2492	2616	spoolsv.exe	30
PID 2616 wrote to memory of 2492	2616	spoolsv.exe	30
PID 2492 wrote to memory of 2480	2492	svchost.exe	31
PID 2492 wrote to memory of 2480	2492	svchost.exe	31
PID 2492 wrote to memory of 2480	2492	svchost.exe	31
PID 2492 wrote to memory of 2480	2492	svchost.exe	31
PID 2492 wrote to memory of 1236	2492	svchost.exe	32
PID 2492 wrote to memory of 1236	2492	svchost.exe	32
PID 2492 wrote to memory of 1236	2492	svchost.exe	32
PID 2492 wrote to memory of 1236	2492	svchost.exe	32
PID 2492 wrote to memory of 1008	2492	svchost.exe	36
PID 2492 wrote to memory of 1008	2492	svchost.exe	36
PID 2492 wrote to memory of 1008	2492	svchost.exe	36
PID 2492 wrote to memory of 1008	2492	svchost.exe	36
PID 2492 wrote to memory of 1176	2492	svchost.exe	38
PID 2492 wrote to memory of 1176	2492	svchost.exe	38
PID 2492 wrote to memory of 1176	2492	svchost.exe	38
PID 2492 wrote to memory of 1176	2492	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\911f5ad32b4413f552e617ac84bb07e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1236
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1008
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 b7dbc6d987712d2961debd6f8ef644207d9b9e27a17f40d8a644b450b4319bb1
MD5 0b62739479ebd1a30aa35128c6435c50
SHA1 2bc9f744a3f850253a798e4f225729a78cd869b7
SHA512 a2f92a29b1a0ab2055b29337522d81c1af8f541fa646c5811e485f3b2edffc83d4f21056af488a390fcf4a6fa92863b7f81bd57d547bc4d83e091b65eda89a96
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi4:IeklMMYJhqezw/pXzH9i4
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\system\svchost.exe
Size 66KB
SHA256 c9d29d53d747fd967c97df012707a0c7b7ec423c4cdc2279a11e533bb2f6cce0
MD5 b6f6400a4c1ecfc84785309950cd8f51
SHA1 ae7f53099d7b1127d035102f202b3b49459f41fa
SHA512 2d9921dde51164d595381be361f72626cd9b1ece6a5ecff2e2303dcf8d6b82f4959922676d71491df4620067e5fa40faaff7007157a0a9d539eeba25b4509961
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiKWWWWWWWWWWWWWWWWWWWWo:IeklMMYJhqezw/pXzH9iV
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \Windows\system\explorer.exe
Size 66KB
SHA256 dfdaf3e34dea03a810be7d00dd3728cdad8d3375152cd409e0536237be112d79
MD5 662cf035a02c089c46a8194e6b9f10a5
SHA1 82cdf3f248498d5d490dcc2e9dcdf38249803d3b
SHA512 efe971557c1d470a1ebd8af00ada53f6a866ef04844e7a616059fbafcdc016e7d4d0afa732d4a44f0a0318c88a2cbb4d1233ac3147f9ae2b8c150ad39916243c
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiO:IeklMMYJhqezw/pXzH9iO
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \Windows\system\spoolsv.exe
Size 66KB
SHA256 b4c8dd3993ce1afb185baf0a27330bb77b590dfc5daa21f5a9bb84832f08cb7d
MD5 ad6b703f7bb72fc71149ab4069072275
SHA1 22f333703bf4ca7fda2a001851e776d71d0c69b2
SHA512 c358664dec2ef866bb48b7ea5784f89205219f8a69096851fa3290ff3a01c25eadc0fe93fdcb3b184a92b62927e44473d55c2dacafde93ce4c0e5ceb32581dce
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXic:IeklMMYJhqezw/pXzH9ic
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2104-18-0x0000000002BC0000-0x0000000002BF1000-memory.dmp

Download

memory/2104-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2104-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2104-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2104-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2104-17-0x0000000002BC0000-0x0000000002BF1000-memory.dmp

Download

memory/2104-1-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/2104-77-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2104-78-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2424-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2424-30-0x0000000002C70000-0x0000000002CA1000-memory.dmp

Download

memory/2424-91-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2424-80-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2424-23-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2480-64-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2480-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2480-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2492-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-82-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2616-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2616-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2616-75-0x0000000000400000-0x0000000000431000-memory.dmp

Download