af7201dfeff1c0c07c063668724e528d511f316916546b2b03958479e0236f6d

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
Size

66KB
MD5

0853d5253c1fae1e1037a86988f8f5a0
SHA1

67b82aa36f74c09463b977263f7ed216234867b8
SHA256

af7201dfeff1c0c07c063668724e528d511f316916546b2b03958479e0236f6d
SHA512

d305969cb675ac6669d3af15e244bf55ddc4f6c8cfe01a3a94ddb32a0f0187043301b285a4228fe0ef566028ed1f53734b8afec5ec54d9153643770601219cc5
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiU:IeklMMYJhqezw/pXzH9iU

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2476-52-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3028	explorer.exe
2648	spoolsv.exe
2476	svchost.exe
2404	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
3028	explorer.exe
3028	explorer.exe
2648	spoolsv.exe
2648	spoolsv.exe
2476	svchost.exe
2476	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
3028	explorer.exe
3028	explorer.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
2476	svchost.exe
2476	svchost.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
2476	svchost.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
2476	svchost.exe
3028	explorer.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe
2476	svchost.exe
3028	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3028	explorer.exe
2476	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
3028	explorer.exe
3028	explorer.exe
2648	spoolsv.exe
2648	spoolsv.exe
2476	svchost.exe
2476	svchost.exe
2404	spoolsv.exe
2404	spoolsv.exe
3028	explorer.exe
3028	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3028	1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe	28
PID 1264 wrote to memory of 3028	1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe	28
PID 1264 wrote to memory of 3028	1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe	28
PID 1264 wrote to memory of 3028	1264	0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe	28
PID 3028 wrote to memory of 2648	3028	explorer.exe	29
PID 3028 wrote to memory of 2648	3028	explorer.exe	29
PID 3028 wrote to memory of 2648	3028	explorer.exe	29
PID 3028 wrote to memory of 2648	3028	explorer.exe	29
PID 2648 wrote to memory of 2476	2648	spoolsv.exe	30
PID 2648 wrote to memory of 2476	2648	spoolsv.exe	30
PID 2648 wrote to memory of 2476	2648	spoolsv.exe	30
PID 2648 wrote to memory of 2476	2648	spoolsv.exe	30
PID 2476 wrote to memory of 2404	2476	svchost.exe	31
PID 2476 wrote to memory of 2404	2476	svchost.exe	31
PID 2476 wrote to memory of 2404	2476	svchost.exe	31
PID 2476 wrote to memory of 2404	2476	svchost.exe	31
PID 2476 wrote to memory of 2172	2476	svchost.exe	32
PID 2476 wrote to memory of 2172	2476	svchost.exe	32
PID 2476 wrote to memory of 2172	2476	svchost.exe	32
PID 2476 wrote to memory of 2172	2476	svchost.exe	32
PID 2476 wrote to memory of 1248	2476	svchost.exe	36
PID 2476 wrote to memory of 1248	2476	svchost.exe	36
PID 2476 wrote to memory of 1248	2476	svchost.exe	36
PID 2476 wrote to memory of 1248	2476	svchost.exe	36
PID 2476 wrote to memory of 1092	2476	svchost.exe	38
PID 2476 wrote to memory of 1092	2476	svchost.exe	38
PID 2476 wrote to memory of 1092	2476	svchost.exe	38
PID 2476 wrote to memory of 1092	2476	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0853d5253c1fae1e1037a86988f8f5a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3028
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2172
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1248
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
56b28c8e226fdebeff069ee2db563784

SHA1
697598c9fde4ee104065fd5337551c0192bb5dab

SHA256
771229d8066fbfefc4f036d23d56dc2194cd9b630dc73919c7c9fa49b3f041de

SHA512
9fe5f5bd293aa7a65481d83ba3115fc7f4131411db9fe447cf43782f923d1f3ea04711902497f1001553684b243d9e6443f9df3b6943a54886ec681bcb339f2b

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
83e6e29634554b354ca0b89c6590cfa9

SHA1
6b7d5d4b2299ca2102652f0aad5a28b26079fe6e

SHA256
ac92f8acd8cd2fb2d756436c3f193580065e807a7e3a8b643a2b11441885c6c4

SHA512
7d2289d363f344f113c997e113f1d5f323992db833de9565a8f8923fda480a5487efa3b31edd183803c87edb5a735e787b18e8bf1a3f689a769175743cabef7e

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
cfe99e4ee1c47b9e48fe803dd9a49bd8

SHA1
d29beff2ea437215dd17b7ac910641c7579b564a

SHA256
bb4061e6daad7e8d4bed9b69ad2a8ec8466ddfe3edc94ded836a23a6f0099df8

SHA512
7512b1a591310383d3a5affa5fcab52a9b92a615dab15376c9359c86f655fc5d21965eb579588cd9ed4c558a37ce110d0d47e6205531a6e50bd55abe67444dbe

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
735c4b94b5d1f14e192ebb6236c0855e

SHA1
ef9a11a0d06ea3c7297e0411b12b6835fed2f444

SHA256
94f93c9ff626ce22afc35fcce1f13f518770a20259b5882c54fc5bbbcbff6fb2

SHA512
91335a17d15ce91ca1cada1ec6f71b17aebb3e77476b257bb5eff639f8135f59cb49a35a3ef3d53531cb505f2881895a90d839c175a75fb9b7ccd5618411104d

Download Submit
memory/1264-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1264-75-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1264-62-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1264-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1264-19-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/1264-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1264-5-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1264-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1264-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2404-69-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2404-64-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2476-52-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2476-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2476-63-0x00000000025D0000-0x0000000002601000-memory.dmp

Filesize
196KB

Download
memory/2476-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3028-34-0x0000000002610000-0x0000000002641000-memory.dmp

Filesize
196KB

Download
memory/3028-35-0x0000000002610000-0x0000000002641000-memory.dmp

Filesize
196KB

Download
memory/3028-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3028-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3028-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3028-17-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3028-88-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download