0931cce738d7aa8b3158870fdfd7f2db842c4681b9d256ef187ee9e5aa3e4926

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
Size

65KB
MD5

b03d14abb6a6bec4065d251a9ee1d880
SHA1

77c9fcb66539a8cc79bcef3bed0a6be46137c6c5
SHA256

0931cce738d7aa8b3158870fdfd7f2db842c4681b9d256ef187ee9e5aa3e4926
SHA512

f7110e64973799cb18f45d2239cc2bd56b3002607828192e82778cd95f2dfaaa4900d2719f2fd30646bb32ec00de660aadd1b8912895ee53940eedd013ba3263
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuGjjjjjjjjjjjjjjjjjjA:7WNqkOJWmo1HpM0MkTUmuGjjjjjjjjjE

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/2012-37-0x0000000075520000-0x000000007567D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1652	explorer.exe
2832	spoolsv.exe
2012	svchost.exe
4428	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
1652	explorer.exe
1652	explorer.exe
1652	explorer.exe
1652	explorer.exe
1652	explorer.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe
2012	svchost.exe
2012	svchost.exe
1652	explorer.exe
1652	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1652	explorer.exe
2012	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
1652	explorer.exe
1652	explorer.exe
2832	spoolsv.exe
2832	spoolsv.exe
2012	svchost.exe
2012	svchost.exe
4428	spoolsv.exe
4428	spoolsv.exe
1652	explorer.exe
1652	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1652	4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe	91
PID 4472 wrote to memory of 1652	4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe	91
PID 4472 wrote to memory of 1652	4472	b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe	91
PID 1652 wrote to memory of 2832	1652	explorer.exe	92
PID 1652 wrote to memory of 2832	1652	explorer.exe	92
PID 1652 wrote to memory of 2832	1652	explorer.exe	92
PID 2832 wrote to memory of 2012	2832	spoolsv.exe	93
PID 2832 wrote to memory of 2012	2832	spoolsv.exe	93
PID 2832 wrote to memory of 2012	2832	spoolsv.exe	93
PID 2012 wrote to memory of 4428	2012	svchost.exe	94
PID 2012 wrote to memory of 4428	2012	svchost.exe	94
PID 2012 wrote to memory of 4428	2012	svchost.exe	94
PID 2012 wrote to memory of 3448	2012	svchost.exe	95
PID 2012 wrote to memory of 3448	2012	svchost.exe	95
PID 2012 wrote to memory of 3448	2012	svchost.exe	95
PID 2012 wrote to memory of 3352	2012	svchost.exe	106
PID 2012 wrote to memory of 3352	2012	svchost.exe	106
PID 2012 wrote to memory of 3352	2012	svchost.exe	106
PID 2012 wrote to memory of 3456	2012	svchost.exe	108
PID 2012 wrote to memory of 3456	2012	svchost.exe	108
PID 2012 wrote to memory of 3456	2012	svchost.exe	108

C:\Users\Admin\AppData\Local\Temp\b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b03d14abb6a6bec4065d251a9ee1d880_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1652
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3448
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3352
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
0b85d538325db6c3e49b14a4f81c3741

SHA1
7da8e58b221647376672362950d91c4c3fe6f40a

SHA256
c364f55dd42e8c81adbbd5d28f4d6d62a6539b936bb88fd1a6ae4dbcc9e1eb75

SHA512
0348e5d8b21a1f6acdc5853854cc34cf7fabd613caac2350311aebc94bf65c91a51f29fc4b09a2d4e850626f6e098e5ba6d4bbd041964404cc243e9468917a7b

Download Submit
C:\Windows\System\explorer.exe

Filesize
65KB

MD5
e56f48b25f63a0b694ec549343b447de

SHA1
f4541f73e63738269b63937efa8cafd7b21daaa9

SHA256
7958c816e0777bce6fd3b161c511b782ff703cd0e83909f1f78f8d92012f0993

SHA512
b6190a7209bbad3d8b8eba08290cf983271e029ac2a93b373dbc500c6397669289f81e80527e10c6e17379507509147c74740235c0efc4408a8dc71a4445ec15

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
1d7357db6d12616360b303888c6b3bb7

SHA1
cb829983f7727d8895c29dbe1f89ab3d79e2b78a

SHA256
75dacb1ecbdd49aac635bae04b9e38aa6762e416f24a523d8fead901a4abeb31

SHA512
92a0840a81ae90101e454d6bf526e10639cbb6cfd33690296202716970cd5285d840adc0487df2662206152795613463c0c98d6a0041055d64d13a8b91202202

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
41f11a5f9764670d25b770d192496357

SHA1
8ec951f3e4fe2d5f90d0cd80f2c75203f787c3ac

SHA256
bd45ff7196bbc66102909921a572dbd5ab6a398f0cbae85d34a22e58895417ca

SHA512
7316d85ca1adf4855b41ffc96a705c421c60534bbdcc5a8757a4f89bc7aa10a2fb98892fc2b11357887cb23cf4aeea629a8fe58fbbad9930bab0bacfe920d384

Download Submit
memory/1652-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1652-14-0x0000000075520000-0x000000007567D000-memory.dmp

Filesize
1.4MB

Download
memory/2012-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2012-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2012-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2012-37-0x0000000075520000-0x000000007567D000-memory.dmp

Filesize
1.4MB

Download
memory/2832-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2832-25-0x0000000075520000-0x000000007567D000-memory.dmp

Filesize
1.4MB

Download
memory/4428-46-0x0000000075520000-0x000000007567D000-memory.dmp

Filesize
1.4MB

Download
memory/4428-45-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4428-51-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4472-41-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4472-35-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4472-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4472-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4472-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4472-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4472-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4472-2-0x0000000075520000-0x000000007567D000-memory.dmp

Filesize
1.4MB

Download
memory/4472-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download