ba9eec35d4cc7a953538e0d38c9439b5838692e4217f24ee6d74ee0c2ba6bf3f

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
Size

65KB
MD5

35a6b34cd556426a4027523f49a2bae0
SHA1

89d19052169778f9a7efb1784ef7a3678e996c81
SHA256

ba9eec35d4cc7a953538e0d38c9439b5838692e4217f24ee6d74ee0c2ba6bf3f
SHA512

9907b51340f308b9fda4332ea1babd405d935425eec7a41a1d427df62f54f944b8741041fc32a5ae81efc22d548046901003f62d17e667e3302724faaae2d376
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuL:7WNqkOJWmo1HpM0MkTUmuL

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2540-56-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2340	explorer.exe
2572	spoolsv.exe
2540	svchost.exe
2536	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
2340	explorer.exe
2340	explorer.exe
2572	spoolsv.exe
2572	spoolsv.exe
2540	svchost.exe
2540	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2340	explorer.exe
2540	svchost.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe
2540	svchost.exe
2340	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2340	explorer.exe
2540	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
2340	explorer.exe
2340	explorer.exe
2572	spoolsv.exe
2572	spoolsv.exe
2540	svchost.exe
2540	svchost.exe
2536	spoolsv.exe
2536	spoolsv.exe
2340	explorer.exe
2340	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2340	1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe	28
PID 1460 wrote to memory of 2340	1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe	28
PID 1460 wrote to memory of 2340	1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe	28
PID 1460 wrote to memory of 2340	1460	35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe	28
PID 2340 wrote to memory of 2572	2340	explorer.exe	29
PID 2340 wrote to memory of 2572	2340	explorer.exe	29
PID 2340 wrote to memory of 2572	2340	explorer.exe	29
PID 2340 wrote to memory of 2572	2340	explorer.exe	29
PID 2572 wrote to memory of 2540	2572	spoolsv.exe	30
PID 2572 wrote to memory of 2540	2572	spoolsv.exe	30
PID 2572 wrote to memory of 2540	2572	spoolsv.exe	30
PID 2572 wrote to memory of 2540	2572	spoolsv.exe	30
PID 2540 wrote to memory of 2536	2540	svchost.exe	31
PID 2540 wrote to memory of 2536	2540	svchost.exe	31
PID 2540 wrote to memory of 2536	2540	svchost.exe	31
PID 2540 wrote to memory of 2536	2540	svchost.exe	31
PID 2540 wrote to memory of 2120	2540	svchost.exe	32
PID 2540 wrote to memory of 2120	2540	svchost.exe	32
PID 2540 wrote to memory of 2120	2540	svchost.exe	32
PID 2540 wrote to memory of 2120	2540	svchost.exe	32
PID 2540 wrote to memory of 1336	2540	svchost.exe	36
PID 2540 wrote to memory of 1336	2540	svchost.exe	36
PID 2540 wrote to memory of 1336	2540	svchost.exe	36
PID 2540 wrote to memory of 1336	2540	svchost.exe	36
PID 2540 wrote to memory of 560	2540	svchost.exe	38
PID 2540 wrote to memory of 560	2540	svchost.exe	38
PID 2540 wrote to memory of 560	2540	svchost.exe	38
PID 2540 wrote to memory of 560	2540	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35a6b34cd556426a4027523f49a2bae0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2120
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1336
    - - C:\Windows\SysWOW64\at.exe
        
        at 17:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
1c0a35485c3533ddbee23dbb55f84e3a

SHA1
da8a7f710c9f3e9712ce0acedda66c913dd7f840

SHA256
98f2b7f8a3abe347edc0e88be7bd115f97d622c1ef5da3427ecdf09764026502

SHA512
11a5c983c63d0d68e0ef830fb555af275e9d7071ad8bc269ee60cc781d1707a06139d934a7b8ff991ad04387431b9e2da3895d85452917af993b37b3a50df947

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
cfef465d63a085b2670a38b5df97d16e

SHA1
d718e1da69e8307b4a34d8a9af045b43effbd72c

SHA256
4e220c1884cec3d33c59eed0dbf129028b6c4f69c0c8464aad3365ae16e93e82

SHA512
37e324b002f7258fb29e0bbe0538d087606a90c2b2a369f7bb8e00bfbd6196bd1e723298d94655074846c7d5f4d16ecd1eb2670983a92a03c64606b2c0a7e9ae

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
854daf1ede0bdb5773917c5a256d2d38

SHA1
7d4788d0829fe6553d0782f324f68ed25f56391b

SHA256
586cba663255308f77e125ee6b1261d3f268847a3202872bb0cdc5fa4e167dc1

SHA512
a7c6f4ab535028a0bd52e548444b9efd2f477e72e8fd752cd1d708acf8a9eed25d68119fede26be52b3e864c770c6dc20c08f76b1dcec970578d829e9e45ea3c

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
cfffdf2e85935a6aabf437b49c2ac4c1

SHA1
d59abda3fba78afbc2665b7c6dc8552ab5dd9767

SHA256
e452671a937e687f025e0a91835c2e6f4b8c36398e136237fb762b004de2009b

SHA512
d9ddf9448cb3eb9b3785b4efc2953059fbbf822e188ebf06253bf726a3953237ad834526b58b0798915dac719b809bfc2ed366ce11cc0462415dadaad986907a

Download Submit
memory/1460-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1460-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1460-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1460-16-0x0000000002650000-0x0000000002681000-memory.dmp

Filesize
196KB

Download
memory/1460-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1460-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1460-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1460-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1460-54-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1460-47-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2340-66-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2340-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2340-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2340-36-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/2340-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2340-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2340-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2340-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2536-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2536-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-55-0x0000000002B70000-0x0000000002BA1000-memory.dmp

Filesize
196KB

Download
memory/2572-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download