c0306c7e7f09095800abd2d806aa585eb18b4cbaea0b128974b5e95317057718

Analysis

max time kernel
150s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
Size 65KB
Sample240602-b9j47sfd65
SHA256 c0306c7e7f09095800abd2d806aa585eb18b4cbaea0b128974b5e95317057718
MD5 1f769dc4cfbbe2b9ce74ad015f46f7d0
SHA1 ab8ce307122506b7ff45e55d7f577ec6ab3e8fdb
SHA512 7d6f4571a7559cd9fefb35ff667f073ef19b985452bd572e24273a42ac4b33faf6a21ccf00cd5821717cd9a8f45452d49c566a2861cb2777ecb588c0f799165f
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouy:7WNqkOJWmo1HpM0MkTUmuy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/4476-38-0x0000000074EA0000-0x0000000074FFD000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4920	explorer.exe
3700	spoolsv.exe
4476	svchost.exe
3504	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
4920	explorer.exe
4920	explorer.exe
4920	explorer.exe
4920	explorer.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe
4920	explorer.exe
4920	explorer.exe
4476	svchost.exe
4476	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4920	explorer.exe
4476	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
4920	explorer.exe
4920	explorer.exe
3700	spoolsv.exe
3700	spoolsv.exe
4476	svchost.exe
4476	svchost.exe
3504	spoolsv.exe
3504	spoolsv.exe
4920	explorer.exe
4920	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4920	1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	81
PID 1616 wrote to memory of 4920	1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	81
PID 1616 wrote to memory of 4920	1616	1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe	81
PID 4920 wrote to memory of 3700	4920	explorer.exe	82
PID 4920 wrote to memory of 3700	4920	explorer.exe	82
PID 4920 wrote to memory of 3700	4920	explorer.exe	82
PID 3700 wrote to memory of 4476	3700	spoolsv.exe	83
PID 3700 wrote to memory of 4476	3700	spoolsv.exe	83
PID 3700 wrote to memory of 4476	3700	spoolsv.exe	83
PID 4476 wrote to memory of 3504	4476	svchost.exe	84
PID 4476 wrote to memory of 3504	4476	svchost.exe	84
PID 4476 wrote to memory of 3504	4476	svchost.exe	84
PID 4476 wrote to memory of 1968	4476	svchost.exe	86
PID 4476 wrote to memory of 1968	4476	svchost.exe	86
PID 4476 wrote to memory of 1968	4476	svchost.exe	86
PID 4476 wrote to memory of 3224	4476	svchost.exe	99
PID 4476 wrote to memory of 3224	4476	svchost.exe	99
PID 4476 wrote to memory of 3224	4476	svchost.exe	99
PID 4476 wrote to memory of 2548	4476	svchost.exe	101
PID 4476 wrote to memory of 2548	4476	svchost.exe	101
PID 4476 wrote to memory of 2548	4476	svchost.exe	101

C:\Users\Admin\AppData\Local\Temp\1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1f769dc4cfbbe2b9ce74ad015f46f7d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4920
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3224
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 9d10494f04aa5e5055a0ee55952976e8f9db2572540b1d57a45e754055b70b4f
MD5 5f9e16503d23b214b0a071d806cfa2d7
SHA1 13ae5847fe8f5fa8e68e3397bc0733df32fbf3ae
SHA512 69dba3b9b036c0b42c6d3291a14d73a2670c98b8fb57409e08025bd8b2471caccb6aafc975ee56666146280f2d57ff48777291a83fc851b08f75e62537055460
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuF:7WNqkOJWmo1HpM0MkTUmuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 8f657649eb11775fa6678af65874e7f0aad31bc209164b19567cf46bbc6c6cfd
MD5 cbacf8fbc028a885bf4804cb83994f04
SHA1 2d199c713f9e22e63cc4c4284fee580e8074effd
SHA512 f5a92cf9783656f6222dff119a3149d2a37baf12a941b7908ff70843691a46c260d02aae53c1ad378a443e9c9dc73cccfb1e584e2ff7f98b4ced5feb20617e63
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuI:7WNqkOJWmo1HpM0MkTUmuI
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 47660363e45167a84ca400977fb81da0e87121d0640cad063b6e36dca73ac257
MD5 307fb5e6241e913f2f76b383791a8a2f
SHA1 4e86487c2d3aaf545302603f3363a77421cc066d
SHA512 e2b526bf62b994f6938fc98e9a77bbcdbd3c690df1742ee92a8bc486486cbfe9db9cf05f195835deaa00b59e535c720af6e2c5c9aedca8b25789a962b47ea0ad
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuG:7WNqkOJWmo1HpM0MkTUmuG
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 df6a916628ed0f8a52cce12726f1afd403aaa6d840a2c92701b2e2074500d0d3
MD5 b03f627c8359b39d8bd1e738e937ed7c
SHA1 0dc8e54dc8c1ee767e275f62e7f74cef1418ad17
SHA512 07ae1ccdf90a536719de3171f1e45b9283f8b67848e097708633d1c7fbc2617acd0ecf55805cf6e0ffc746e65ad6095428374b436ef069f78234e92ae7c0f5b9
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuL:7WNqkOJWmo1HpM0MkTUmuL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1616-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1616-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1616-2-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

Download

memory/1616-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1616-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1616-57-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1616-58-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1616-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3504-44-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

Download

memory/3504-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3700-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3700-26-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

Download

memory/3700-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3700-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4476-38-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

Download

memory/4476-37-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4476-62-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4920-13-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

Download

memory/4920-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4920-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4920-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4920-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download