Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 01:38

General

  • Target

    1db53fb00e27e3b5cde19816d55800d0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    1db53fb00e27e3b5cde19816d55800d0

  • SHA1

    fe2c7b8ad6bead7dff531e8f03b6065f9ad25728

  • SHA256

    8a97c0167aa6144e0f66aaa6f17a3ff1df9b5ef4d90ba749c65aad87b670c7ab

  • SHA512

    79e88cc0d0c1b85eaa63822d06a1da0efc74e75200337e78c16db200ac269164a7f87da3d83010f43ebb669d7a06cdb7b7cf555242afb7e24acacb68d0110ac5

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiN:IeklMMYJhqezw/pXzH9iN

Malware Config

Signatures

  • Detects BazaLoader malware 1 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1db53fb00e27e3b5cde19816d55800d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1db53fb00e27e3b5cde19816d55800d0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1992
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2504
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2716
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2804
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2416
          • C:\Windows\SysWOW64\at.exe
            at 01:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1892
            • C:\Windows\SysWOW64\at.exe
              at 01:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2104
              • C:\Windows\SysWOW64\at.exe
                at 01:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2968

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          737137a203618d13aba1af750429ca9f

          SHA1

          a0fcd4b51b03ceff5bc8a5150f954fe171089969

          SHA256

          983ac94a69dc3ab735ab100426aed8b1cc6e7ec39875471cfa64f025158c529a

          SHA512

          bdf3d6d09cc5ae0791174f6592cdb1402aae065fd6655e177c06fdf2d774a0f507efcbea483e9a8f8197340d3403a170f8858d63c6320d161727a060fbabf89c

        • C:\Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          3539d32997123cb05d43a043840ba31c

          SHA1

          27b57261d17e8b7775012a51eef24f5312543700

          SHA256

          b635c720fe6f9612bf36315239d720a140a0c4725bb8852bb9d68bf60bdde997

          SHA512

          3d026a6265261a0247462151f3e040fd0e2d01f5d96cb4604911ef3fef8fc54889440b985d21ee191f7963bef3d1181d0fcfd7fbc04444330f1acd7776c87b39

        • \??\c:\windows\system\explorer.exe

          Filesize

          66KB

          MD5

          1cf7c1d4f802e6e680b0c422df721a2d

          SHA1

          d6747981fa371b924dc20428fb49ff874404bb65

          SHA256

          f5c6fd710d089bbb83364c3a9407e9bde05be5078f10fc5fd92edddffaa90321

          SHA512

          ee79572e94c042c71d010ce8e08c4c4d25bc2793e1a4c9c75c064dadebcf295c42726f2bb4ca34a9a0c0452657510aad58174012200a207b0bcdd8d79ce97dd8

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          2979516a72119bb4d8745a626b4af285

          SHA1

          434de048dfc27209d758b6b75502f4d3ea6f5755

          SHA256

          54db52c8b8d7c285e7335c256626ae177419a1b0f0e5229e62cd89b3836fb9f0

          SHA512

          1e5096b1a4571cceede4d52c99fd806270a8b1d43a99f611fe6dd1a794ad5b57a37276ad75897bb17929c5e85a7a4a79726f0dfd2bf5548f3e443d4597fbc39e

        • memory/1992-0-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/1992-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1992-62-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1992-2-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/1992-6-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1992-76-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1992-75-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1992-17-0x00000000026A0000-0x00000000026D1000-memory.dmp

          Filesize

          196KB

        • memory/1992-1-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2416-69-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2416-64-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2504-18-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2504-90-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2504-79-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2504-78-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2504-19-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2504-23-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2716-36-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2716-73-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2716-40-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2716-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2804-63-0x00000000025A0000-0x00000000025D1000-memory.dmp

          Filesize

          196KB

        • memory/2804-52-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2804-81-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2804-56-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB