6686a46b9f36495af140c0c600e6436edb3d9165260e9a82d57b1475943e051f

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
Size 66KB
Sample240603-p6546agf37
SHA256 6686a46b9f36495af140c0c600e6436edb3d9165260e9a82d57b1475943e051f
MD5 a435521de9bb8ce722f46b8682f4f4a0
SHA1 433f1c5bb9f705194a92e08c7fa9ab90f6e7c5ce
SHA512 ec8ac78511ae3cce913d958d1b22740fbed4a8ca1ecc54e03302ec287a7cb93aee2f53feba16cedd81ef529fca10f89a01070b139ae5a22335727c103a573f37
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiFEEEEEEEEEEEEEEEEEEEEi:IeklMMYJhqezw/pXzH9iU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/3540-37-0x0000000074DA0000-0x0000000074EFD000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3624	explorer.exe
1836	spoolsv.exe
3540	svchost.exe
4956	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe
3624	explorer.exe
3540	svchost.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3540	svchost.exe
3540	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3624	explorer.exe
3540	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
3624	explorer.exe
3624	explorer.exe
1836	spoolsv.exe
1836	spoolsv.exe
3540	svchost.exe
3540	svchost.exe
4956	spoolsv.exe
4956	spoolsv.exe
3624	explorer.exe
3624	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3624	3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe	82
PID 3612 wrote to memory of 3624	3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe	82
PID 3612 wrote to memory of 3624	3612	a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe	82
PID 3624 wrote to memory of 1836	3624	explorer.exe	83
PID 3624 wrote to memory of 1836	3624	explorer.exe	83
PID 3624 wrote to memory of 1836	3624	explorer.exe	83
PID 1836 wrote to memory of 3540	1836	spoolsv.exe	84
PID 1836 wrote to memory of 3540	1836	spoolsv.exe	84
PID 1836 wrote to memory of 3540	1836	spoolsv.exe	84
PID 3540 wrote to memory of 4956	3540	svchost.exe	85
PID 3540 wrote to memory of 4956	3540	svchost.exe	85
PID 3540 wrote to memory of 4956	3540	svchost.exe	85
PID 3540 wrote to memory of 772	3540	svchost.exe	87
PID 3540 wrote to memory of 772	3540	svchost.exe	87
PID 3540 wrote to memory of 772	3540	svchost.exe	87
PID 3540 wrote to memory of 2692	3540	svchost.exe	100
PID 3540 wrote to memory of 2692	3540	svchost.exe	100
PID 3540 wrote to memory of 2692	3540	svchost.exe	100
PID 3540 wrote to memory of 1208	3540	svchost.exe	102
PID 3540 wrote to memory of 1208	3540	svchost.exe	102
PID 3540 wrote to memory of 1208	3540	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a435521de9bb8ce722f46b8682f4f4a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3624
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
    - - C:\Windows\SysWOW64\at.exe
        
        at 12:59 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:772
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:00 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2692
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:01 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 37a0fe94c544267d5b1567ab289ad43706644bd7d8e8512fe0507106dd0d74b0
MD5 85bdb99c1cf1c78c3d26a28b4b0e5163
SHA1 05a4f52b523da238de4b6f74fa5a92dceb961c75
SHA512 48b2e690956426cd578db7c6c49bbb8c32dbdf9cbbea8bd2ce812bd9354c9e4dcc301dd8e3399ac184c3398fca91ab4046a8ea305a579bd125f03896cd9833b3
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiN:IeklMMYJhqezw/pXzH9iN
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 19deb1d1ac0afe55dca220b69489413e6bf8c41ef897503be6d7dacbdd6a0962
MD5 ce911ceb5b16fea7835b234448668bb3
SHA1 f1efabf34e374939183f7ebc5418701727b8ab94
SHA512 64c321c8f1adabbbacbbb66f3c7c64f7d567f9bb7455a00bcee4f99da833e784953fff8f3844764e48d4417b15d292afa976c6622a8b329dbcaef2cc5ffe20a3
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXig:IeklMMYJhqezw/pXzH9ig
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 5485886ff3eee22381a68fb9f43c4f1c72dc6a9ff497ccb6df70df95965b19cc
MD5 37115d1651d9c0964483564223c67dcc
SHA1 d4152088ce52b4d6e832439775336b31e22af9fa
SHA512 563743cec8018f82c2233f007f91ce3fc9a7709b3fe82f5d1df3188b99451f5908ad4d4d02b921801835bf696c7f17e31bc58d0ff2b309bd4ef7764122ac5a59
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi4:IeklMMYJhqezw/pXzH9i4
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 dd69d3c33453ce3759a2aca81ebcfea97c39b6a11f0e93791febf05b3994a82d
MD5 4e81ee669a6f0a8a9b79a673e7674508
SHA1 9b48948ec905179771a92e73af8ce93a20536207
SHA512 64c2643b7eaf1a3219c3a256bc4870cc17e3f6dd01f8ded5f6aa4c72231371b0e63a399d91969ae8343cf8d7a554f40f0c75075822bb7151a6ae82e37a5a765e
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXic:IeklMMYJhqezw/pXzH9ic
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1836-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1836-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1836-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1836-26-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/3540-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3540-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3540-37-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/3612-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3612-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3612-6-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3612-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3612-2-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/3612-56-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3612-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3624-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3624-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3624-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3624-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3624-13-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download

memory/4956-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4956-44-0x0000000074DA0000-0x0000000074EFD000-memory.dmp

Download