b49b2cf057f8a2ffbb926a03db8f8891055116b194c151c82de3c02b2f835911

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe
Size 65KB
Sample240603-nc13nsce3v
SHA256 b49b2cf057f8a2ffbb926a03db8f8891055116b194c151c82de3c02b2f835911
MD5 a175cada6d71032eef3a967bbbc7bbb0
SHA1 46476fcb015c551a11a5f1fbe4f8ca7a93097b3a
SHA512 28caa2f434c70274e02568e76b843ad925d2c9e88175759efc48d0c27742ba02a6a8797122c9ff38823f9539710bd06525dde4fac7ae5cd4d7323fa4b18224d0
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuM:7WNqkOJWmo1HpM0MkTUmuM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/4428-35-0x0000000074F30000-0x000000007508D000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4224	explorer.exe
3480	spoolsv.exe
4428	svchost.exe
1592	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe
1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe
4224	explorer.exe
4224	explorer.exe
4224	explorer.exe
4224	explorer.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe
4224	explorer.exe
4224	explorer.exe
4428	svchost.exe
4428	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4224	explorer.exe
4428	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe
1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe
4224	explorer.exe
4224	explorer.exe
3480	spoolsv.exe
3480	spoolsv.exe
4428	svchost.exe
4428	svchost.exe
1592	spoolsv.exe
1592	spoolsv.exe
4224	explorer.exe
4224	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4224	1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 4224	1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 4224	1020	a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe	81
PID 4224 wrote to memory of 3480	4224	explorer.exe	82
PID 4224 wrote to memory of 3480	4224	explorer.exe	82
PID 4224 wrote to memory of 3480	4224	explorer.exe	82
PID 3480 wrote to memory of 4428	3480	spoolsv.exe	83
PID 3480 wrote to memory of 4428	3480	spoolsv.exe	83
PID 3480 wrote to memory of 4428	3480	spoolsv.exe	83
PID 4428 wrote to memory of 1592	4428	svchost.exe	84
PID 4428 wrote to memory of 1592	4428	svchost.exe	84
PID 4428 wrote to memory of 1592	4428	svchost.exe	84
PID 4428 wrote to memory of 4784	4428	svchost.exe	85
PID 4428 wrote to memory of 4784	4428	svchost.exe	85
PID 4428 wrote to memory of 4784	4428	svchost.exe	85
PID 4428 wrote to memory of 1800	4428	svchost.exe	95
PID 4428 wrote to memory of 1800	4428	svchost.exe	95
PID 4428 wrote to memory of 1800	4428	svchost.exe	95
PID 4428 wrote to memory of 1924	4428	svchost.exe	97
PID 4428 wrote to memory of 1924	4428	svchost.exe	97
PID 4428 wrote to memory of 1924	4428	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a175cada6d71032eef3a967bbbc7bbb0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4224
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4784
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1800
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 b5211475ae5b30e074a6e6ee18c3de065c6e17aa2a6758a8402e98881137c197
MD5 3eb51fc0a2246bb1231affbdbe1b144b
SHA1 f4bd0ad84c7aea46c7a1fc4ff051fe18300e134f
SHA512 b0da78d5dd4289856d60bf9eb5350f9b1c0d34b27c6acfcb6e22c1a2b446e3085b9e912fa9af6200f063f5eb38466172885ddec51092ff04cfb6c1347ff044be
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuU:7WNqkOJWmo1HpM0MkTUmuU
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 e650b79793e9a24e4f154359c5706d9903556dc528e592e205403603077798fa
MD5 da6daf2a2b31ef995c924b71bb5b3519
SHA1 ec1c29f08db4e2ac56bb14fc8a79ffacde98a856
SHA512 708b5934aa02f08bc218a9a0ea2a5ccc5d13fc24af759be4cf597a918aafee473a8a89668b8fc039c00123d3ce47109abffbc11d3e8542dfb6dd537ee38d8142
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oug:7WNqkOJWmo1HpM0MkTUmug
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 356f4f6cfba85d867502defdb08a3755a6403ac7811dc4828b22a64f395372e6
MD5 e4edef5cc74ddbd7a3e849932d154d61
SHA1 af53ee4177c132d2bb26f94497bf30b0eaf1a4cd
SHA512 c04cd9ab45bb9e511184fe9f6802745fe7bc30252f16fa2d8b3da1e47c764d332feb43f31996f645c34c5301ea625ff2296918917206622a09c54af4dc3738ab
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuR:7WNqkOJWmo1HpM0MkTUmuR
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 6a2668023e799023f9d3ccf48734fecf4b4b5c1568f130b6daf5caf9e67e38f9
MD5 e6d1a566d98c3f89a95ad7db0a9c6363
SHA1 493b137486e828b1571a42aca0b26852821e4d32
SHA512 bb5486c3d461fcd94a75505ca25eea70931dd6e1da0a905f4dafb05c5d807464d8e5fa0e4c9f875e36dfac003628720295b9a7a61a80ebe4d3314dab4b6d2bed
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou5:7WNqkOJWmo1HpM0MkTUmu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1020-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1020-2-0x0000000074F30000-0x000000007508D000-memory.dmp

Download

memory/1020-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1020-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1020-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1020-54-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1592-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1592-42-0x0000000074F30000-0x000000007508D000-memory.dmp

Download

memory/1592-49-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3480-25-0x0000000074F30000-0x000000007508D000-memory.dmp

Download

memory/3480-51-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4224-12-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4224-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4224-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4224-67-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4224-14-0x0000000074F30000-0x000000007508D000-memory.dmp

Download

memory/4428-35-0x0000000074F30000-0x000000007508D000-memory.dmp

Download

memory/4428-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download