Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-06-2024 00:44

General

  • Target

    15edec74517a6782f2f92c29c4c0b3f0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    15edec74517a6782f2f92c29c4c0b3f0

  • SHA1

    cfc65e3486a1f838b490365c3d14fe0f722a02bb

  • SHA256

    a29c7d4e0412390e69347593415f6c2b99efff5e875dcdd69dbd97353b46024f

  • SHA512

    911239892ef95e5bea995d7c04df6b0cb276e0e15b2ee9aa44e5d1739170b6761b6d30dd5f9bda39bc06cbe553a57565024a9f9bfcafdfe98589dce476aaa75e

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiJ:IeklMMYJhqezw/pXzH9iJ

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15edec74517a6782f2f92c29c4c0b3f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\15edec74517a6782f2f92c29c4c0b3f0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2192
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2148
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2540
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2684
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2400
          • C:\Windows\SysWOW64\at.exe
            at 00:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2688
            • C:\Windows\SysWOW64\at.exe
              at 00:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2064
              • C:\Windows\SysWOW64\at.exe
                at 00:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1252

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          8101b9963a04bd643f0ed44c77d87b53

          SHA1

          a9e7b378fd77088619e0c1de860e64f7688c75e0

          SHA256

          a2d0b2fa8edfee44d177fd9d43409e8664876dda20552c474d1826edafaa7ed6

          SHA512

          394b085ca636abe34cb6056a1b82e369c9632b8aed5da3522dbd0562a7a6891398e8e81db1db8dddb32e7c9578262491919903aab4182ce77a1fd634bb7a4f87

        • C:\Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          bcd209679742445899850a83a5f8b524

          SHA1

          3bd209d9ed84e03eb5abf92922e2d623f9ce513a

          SHA256

          90f7cdba864a37c1ebcd583ab54a40a9a90be5a2191da4bdda322d4ee8f0fc0c

          SHA512

          3cea3ea76b8dad3b7a8d0f34c66d4112e18de269cc55a722b34d1841e00c2b3be4b81bb1fc1a2230ac37cc6281e9a5aea2a71817c9e332085b1fffda9a6e2d75

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          fc23a0861a9a971598bdf028093f2169

          SHA1

          a8b29b9e913f5fc86384b88467bd25ea28512adf

          SHA256

          22fa562dd5fcd636f3a8b5a7fd7010de3fdc080030c82f11f413c4f547ce64f7

          SHA512

          32b29cc6aa0a261cc50652d9e519730294869c9eec3e82b81537602a4772928bf9b7103a3c70feac421941f3f1e4e1694c47e2f5a9e57b631ef2cb4998f2c3d7

        • \Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          1ddb983ec33ff5ebe7780c2640258f7b

          SHA1

          3ad3b591098b5653c6b7fb677639d42bc3d76f06

          SHA256

          406e48e75b7f5a9ba7a6600ca83464195cf51e8512c909fa929561de6229ea49

          SHA512

          646eebe7565f0df842f7d7b022d23eda3bb800223277b2a999312808d36212240d778cff242eadf7480d0595430a70b967f74efc054abb12d358fb53f5d47bff

        • memory/2148-35-0x0000000002680000-0x00000000026B1000-memory.dmp

          Filesize

          196KB

        • memory/2148-19-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2148-93-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2148-18-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2148-82-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2148-23-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2148-81-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2192-65-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2192-17-0x0000000003370000-0x00000000033A1000-memory.dmp

          Filesize

          196KB

        • memory/2192-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2192-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2192-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2192-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2192-79-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2192-78-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2192-62-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2192-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2400-74-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2400-68-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2400-67-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2540-77-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2540-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2540-37-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2540-36-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2684-66-0x0000000003070000-0x00000000030A1000-memory.dmp

          Filesize

          196KB

        • memory/2684-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2684-54-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2684-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2684-84-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB