dc8495127b15a229f94a8f5ae55b77f46e60e6ba085f1f8b41d142e83ff72878

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
Size 65KB
Sample240604-cjd1yahf7v
SHA256 dc8495127b15a229f94a8f5ae55b77f46e60e6ba085f1f8b41d142e83ff72878
MD5 2013747f7f8350d54597b6f8a8d59170
SHA1 07955dec89697126bd2e01c7fcda5efa4b7502ea
SHA512 db806477345950535bfe90ee8c3e05bcf3741bb85af2f13aadbc80154a7e086f7474c674e895de2776c5feb0fc3e30c87e39b8861077ab06a8225f7a8189c762
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou9wwwwwwwwwwwwwwwwww9:7WNqkOJWmo1HpM0MkTUmu9wwwwwwwwwa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral2/memory/4024-38-0x0000000074D80000-0x0000000074EDD000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
540	explorer.exe
1476	spoolsv.exe
4024	svchost.exe
2500	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
4024	svchost.exe
4024	svchost.exe
4024	svchost.exe
540	explorer.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
4024	svchost.exe
540	explorer.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
4024	svchost.exe
540	explorer.exe
540	explorer.exe
4024	svchost.exe
4024	svchost.exe
540	explorer.exe
540	explorer.exe
4024	svchost.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe
540	explorer.exe
4024	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
540	explorer.exe
4024	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
540	explorer.exe
540	explorer.exe
1476	spoolsv.exe
1476	spoolsv.exe
4024	svchost.exe
4024	svchost.exe
2500	spoolsv.exe
2500	spoolsv.exe
540	explorer.exe
540	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 540	232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe	82
PID 232 wrote to memory of 540	232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe	82
PID 232 wrote to memory of 540	232	2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe	82
PID 540 wrote to memory of 1476	540	explorer.exe	83
PID 540 wrote to memory of 1476	540	explorer.exe	83
PID 540 wrote to memory of 1476	540	explorer.exe	83
PID 1476 wrote to memory of 4024	1476	spoolsv.exe	84
PID 1476 wrote to memory of 4024	1476	spoolsv.exe	84
PID 1476 wrote to memory of 4024	1476	spoolsv.exe	84
PID 4024 wrote to memory of 2500	4024	svchost.exe	85
PID 4024 wrote to memory of 2500	4024	svchost.exe	85
PID 4024 wrote to memory of 2500	4024	svchost.exe	85
PID 4024 wrote to memory of 4016	4024	svchost.exe	86
PID 4024 wrote to memory of 4016	4024	svchost.exe	86
PID 4024 wrote to memory of 4016	4024	svchost.exe	86
PID 4024 wrote to memory of 2996	4024	svchost.exe	100
PID 4024 wrote to memory of 2996	4024	svchost.exe	100
PID 4024 wrote to memory of 2996	4024	svchost.exe	100
PID 4024 wrote to memory of 1552	4024	svchost.exe	110
PID 4024 wrote to memory of 1552	4024	svchost.exe	110
PID 4024 wrote to memory of 1552	4024	svchost.exe	110

C:\Users\Admin\AppData\Local\Temp\2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2013747f7f8350d54597b6f8a8d59170_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:540
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4016
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2996
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 5d484ab39e3ae82cb522df3c602f44b368edbc91d60c5ffdb90d6522e5deaee1
MD5 80ec2fd8f6959eaa2b7acf6b5dd8a0e4
SHA1 cd93e7e47156d71002dc035d1b5bd3ecbbe6c39f
SHA512 8ed430ca0003a0773d62124799b3245125d482cd719a1d02743452b1eecca25d7038d91870b03cabcf09ed236eb34c625f6b66ef4343fb4fe6402cc0f30085bc
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oug:7WNqkOJWmo1HpM0MkTUmug
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 e009e44e46af60c2b9a455b683cbe5b83ced26de4ea33963aec6d2ef640c3415
MD5 0622c019bcb36adf1217dd20755f7719
SHA1 36c32f4ab6175da115d60e1ef0402d1500a3b771
SHA512 abe4947a9c058f2d326eb0481806cb12ae7579623ccb49ab2367201a7a73a83f5069357da48b6d076ee2ff91d0755dc56bddf35fe72b8eb3a2be5518e736a158
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuSTTTTTTTTTTTTTTTTTTH:7WNqkOJWmo1HpM0MkTUmuSTTTTTTTTTz
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 eaf68573e48c352e54b81225ce6886a12f3a481c9321036aab82c4d2725a3f41
MD5 7e8340d551661b176876636b314dde32
SHA1 36e185fe3bfd51051b32d882d16616a831ae1efe
SHA512 cab59c69562ffd027634a6a38f0a3ea8c3743cc273b699e59ffe02a8dda739b219b199995b6186bf2024be8a43a08ca8cda69c623c2f0baf6d80607d7fd329fe
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou5zzzzzzzzzzzzzzzzzzD:7WNqkOJWmo1HpM0MkTUmup
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 65KB
SHA256 fd8c38824cd206dc0515bae2d29755152f13f05a5175a729782efaeeaf169e8c
MD5 882e8beaf92e48912814d5114bafddea
SHA1 44f7e18c5f36a6966febbe0f441e51eb18a02273
SHA512 ef3fb30909df6bf4d785535d8c60435414bb2aefed63ff91b873a15efc0208ef82cb9253f4eb202c0bfa7322eaa388cac1abcc6dffa1c69cf2c8641b4844e2ee
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouo:7WNqkOJWmo1HpM0MkTUmuo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/232-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/232-2-0x0000000074D80000-0x0000000074EDD000-memory.dmp

Download

memory/232-58-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/232-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/232-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/232-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/540-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/540-14-0x0000000074D80000-0x0000000074EDD000-memory.dmp

Download

memory/540-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/540-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/540-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/540-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1476-31-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1476-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1476-29-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1476-26-0x0000000074D80000-0x0000000074EDD000-memory.dmp

Download

memory/2500-51-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2500-45-0x0000000074D80000-0x0000000074EDD000-memory.dmp

Download

memory/4024-38-0x0000000074D80000-0x0000000074EDD000-memory.dmp

Download

memory/4024-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4024-62-0x0000000000400000-0x0000000000431000-memory.dmp

Download