c0306c7e7f09095800abd2d806aa585eb18b4cbaea0b128974b5e95317057718

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
Size

65KB
MD5

1f769dc4cfbbe2b9ce74ad015f46f7d0
SHA1

ab8ce307122506b7ff45e55d7f577ec6ab3e8fdb
SHA256

c0306c7e7f09095800abd2d806aa585eb18b4cbaea0b128974b5e95317057718
SHA512

7d6f4571a7559cd9fefb35ff667f073ef19b985452bd572e24273a42ac4b33faf6a21ccf00cd5821717cd9a8f45452d49c566a2861cb2777ecb588c0f799165f
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouy:7WNqkOJWmo1HpM0MkTUmuy

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2100-54-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2484	explorer.exe
2596	spoolsv.exe
2100	svchost.exe
2448	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
2484	explorer.exe
2484	explorer.exe
2596	spoolsv.exe
2596	spoolsv.exe
2100	svchost.exe
2100	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
2484	explorer.exe
2484	explorer.exe
2484	explorer.exe
2100	svchost.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe
2484	explorer.exe
2100	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2484	explorer.exe
2100	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
2484	explorer.exe
2484	explorer.exe
2596	spoolsv.exe
2596	spoolsv.exe
2100	svchost.exe
2100	svchost.exe
2448	spoolsv.exe
2448	spoolsv.exe
2484	explorer.exe
2484	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2484	3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	28
PID 3040 wrote to memory of 2484	3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	28
PID 3040 wrote to memory of 2484	3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	28
PID 3040 wrote to memory of 2484	3040	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	28
PID 2484 wrote to memory of 2596	2484	explorer.exe	29
PID 2484 wrote to memory of 2596	2484	explorer.exe	29
PID 2484 wrote to memory of 2596	2484	explorer.exe	29
PID 2484 wrote to memory of 2596	2484	explorer.exe	29
PID 2596 wrote to memory of 2100	2596	spoolsv.exe	30
PID 2596 wrote to memory of 2100	2596	spoolsv.exe	30
PID 2596 wrote to memory of 2100	2596	spoolsv.exe	30
PID 2596 wrote to memory of 2100	2596	spoolsv.exe	30
PID 2100 wrote to memory of 2448	2100	svchost.exe	31
PID 2100 wrote to memory of 2448	2100	svchost.exe	31
PID 2100 wrote to memory of 2448	2100	svchost.exe	31
PID 2100 wrote to memory of 2448	2100	svchost.exe	31
PID 2100 wrote to memory of 2260	2100	svchost.exe	32
PID 2100 wrote to memory of 2260	2100	svchost.exe	32
PID 2100 wrote to memory of 2260	2100	svchost.exe	32
PID 2100 wrote to memory of 2260	2100	svchost.exe	32
PID 2100 wrote to memory of 2792	2100	svchost.exe	36
PID 2100 wrote to memory of 2792	2100	svchost.exe	36
PID 2100 wrote to memory of 2792	2100	svchost.exe	36
PID 2100 wrote to memory of 2792	2100	svchost.exe	36
PID 2100 wrote to memory of 1592	2100	svchost.exe	38
PID 2100 wrote to memory of 1592	2100	svchost.exe	38
PID 2100 wrote to memory of 1592	2100	svchost.exe	38
PID 2100 wrote to memory of 1592	2100	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2484
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2260
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2792
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
77481aa83a9a9aeafd8d5d6ecfa79a3b

SHA1
0da8d3e4a5cd3b6781619d75d0d68ffd6a414dfc

SHA256
40beb0af7fd09dc5278088790f9dcc1b77ef0cb9979d2bb19ea25e3946704fb0

SHA512
d2c8bd52c96294bdee42f8962ba2b9b61ff7436e2bb36cd983534fb370bfc21f776d64678b1be4d5a37b113deb07b65f0ccb6e5350f61e87eea9241e05fe5cdd

Download Submit
C:\Windows\system\svchost.exe

Filesize
65KB

MD5
556a5035f1d956b1e15a36bc55ef93b7

SHA1
385794dfcf6f3416e721b15e67551b85c0a14082

SHA256
12296e5a15b6a697698900754e1933bbcd2397fbda7139ecda682488a34fbb33

SHA512
08ff0039b87b4a0b0dab768d36f60dce693e7fb8d5f12f8ce194da5a91bfc439016cdcaaf794c164e96052b2740fc9092b509d1e91f88459f28cc3057a0c528e

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
a40cea876ab7533ffdc42ccc4d976351

SHA1
76961e687c18d9190977efabeb1d836e3217d7c2

SHA256
b3a42afdfb3b0bf4b7eec33aec0d6d2cea75d2bc26c2e2f2016f8ecab322470a

SHA512
dff63f545881434643b90c55183bad6d90d24869d4a6acb87dbcf78df36c2a2d38963fded0a85ec5782aeb49db599cc6f3f896816e23ae5e34725b2f0ded96d0

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
c111fd14395a004dee3e4b2d137274a6

SHA1
f7a0aaed1419f7e5ad88cb4acd9e9365449b4e62

SHA256
2e662f76b7fe9ebb1834058299aa2e0b04b30fea39634ac4d00a133a749ef9a9

SHA512
43dc69e977f3c5538a206043a8d1579ade26e7d6564c0f9d8950e11304ba29455b29824f41ea3c6550a05b8e3428539e35f073766a362dcd920a4ecf4ad8cd23

Download Submit
memory/2100-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2100-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2100-64-0x0000000000570000-0x00000000005A1000-memory.dmp

Filesize
196KB

Download
memory/2100-65-0x0000000000570000-0x00000000005A1000-memory.dmp

Filesize
196KB

Download
memory/2100-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2484-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-35-0x0000000002780000-0x00000000027B1000-memory.dmp

Filesize
196KB

Download
memory/2484-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2484-91-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2596-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3040-17-0x0000000003260000-0x0000000003291000-memory.dmp

Filesize
196KB

Download
memory/3040-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3040-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3040-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3040-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3040-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3040-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3040-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download