f45ad6df01ab4a1d2265d2c8fcb18cfee78973b45ded697c0fadaecf5e0e6296

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
Size

66KB
MD5

94a7c93648d0812e1503ed97e20bd550
SHA1

b1160b6befb4075444bf753c54a56d3a03c1f346
SHA256

f45ad6df01ab4a1d2265d2c8fcb18cfee78973b45ded697c0fadaecf5e0e6296
SHA512

bc01eb604324f900d71fb39c3e2536e0574ffa846193880967057e22d4b45ee9e246bd03252defa493abbc230ca0001b9353c54a1d5893a6fae47346c7680fd3
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXim:IeklMMYJhqezw/pXzH9im

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2668-55-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2904	explorer.exe
2532	spoolsv.exe
2668	svchost.exe
2464	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
2904	explorer.exe
2904	explorer.exe
2532	spoolsv.exe
2532	spoolsv.exe
2668	svchost.exe
2668	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2668	svchost.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2904	explorer.exe
2668	svchost.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe
2904	explorer.exe
2668	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2904	explorer.exe
2668	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
2904	explorer.exe
2904	explorer.exe
2532	spoolsv.exe
2532	spoolsv.exe
2668	svchost.exe
2668	svchost.exe
2464	spoolsv.exe
2464	spoolsv.exe
2904	explorer.exe
2904	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2904	2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe	28
PID 2508 wrote to memory of 2904	2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe	28
PID 2508 wrote to memory of 2904	2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe	28
PID 2508 wrote to memory of 2904	2508	94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe	28
PID 2904 wrote to memory of 2532	2904	explorer.exe	29
PID 2904 wrote to memory of 2532	2904	explorer.exe	29
PID 2904 wrote to memory of 2532	2904	explorer.exe	29
PID 2904 wrote to memory of 2532	2904	explorer.exe	29
PID 2532 wrote to memory of 2668	2532	spoolsv.exe	30
PID 2532 wrote to memory of 2668	2532	spoolsv.exe	30
PID 2532 wrote to memory of 2668	2532	spoolsv.exe	30
PID 2532 wrote to memory of 2668	2532	spoolsv.exe	30
PID 2668 wrote to memory of 2464	2668	svchost.exe	31
PID 2668 wrote to memory of 2464	2668	svchost.exe	31
PID 2668 wrote to memory of 2464	2668	svchost.exe	31
PID 2668 wrote to memory of 2464	2668	svchost.exe	31
PID 2668 wrote to memory of 2880	2668	svchost.exe	32
PID 2668 wrote to memory of 2880	2668	svchost.exe	32
PID 2668 wrote to memory of 2880	2668	svchost.exe	32
PID 2668 wrote to memory of 2880	2668	svchost.exe	32
PID 2668 wrote to memory of 2020	2668	svchost.exe	36
PID 2668 wrote to memory of 2020	2668	svchost.exe	36
PID 2668 wrote to memory of 2020	2668	svchost.exe	36
PID 2668 wrote to memory of 2020	2668	svchost.exe	36
PID 2668 wrote to memory of 2948	2668	svchost.exe	38
PID 2668 wrote to memory of 2948	2668	svchost.exe	38
PID 2668 wrote to memory of 2948	2668	svchost.exe	38
PID 2668 wrote to memory of 2948	2668	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\94a7c93648d0812e1503ed97e20bd550_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2880
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\at.exe
        
        at 11:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
daeb8d0b37f04c10aec52fdcd1694386

SHA1
1bb85cf2cdf10b5c3e41dac50974598e8484918a

SHA256
10cf0f670451dd387c4223eeb0079db8621c885988d9593a6d1f4678c52b6998

SHA512
7a9399a519bd50257a9778e42f6701890789f7d165148b92ffde60911f08c3ddb19abc158d3296041d803311a2232a0e0e65cab75c1fdcdfe94bae4d5ef50daf

Download Submit
C:\Windows\system\explorer.exe

Filesize
66KB

MD5
1acaafc3102a3fe952bdbdc43eb29659

SHA1
9ac0c8695d9ffe7600c5ed78edfaa7218cfdef46

SHA256
0586f0cf2ba6afbec71a1c08643cdf2cfa360ca077357dd0d3ed5481838d649b

SHA512
f1e6dee413e287e3a5f5f6e5d9761048a1a15833ab127b537bcda218270a8cadd694bea661f3b9a64e37457ae6dc4e4060afdd87b6e351d446e7e63c916e8414

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
9e0da5d3a834a72302255c398345a08b

SHA1
ddcaec79084877e52376448a06c5a7fa4e2b6389

SHA256
e1832c958e851c462f93c3f69294c912e8b73dcde2e582b6324314e1e8eed90d

SHA512
ab32d7e8f733fd923bceea42153002eab65d107a5321e207bddc78210bc56d04a29c3c74b4c1d2a2cf9d13f47cabe839dc26a327fd42518496c82cc3da7a4ca6

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
e893b41f7b7a845188d77223eb94a6ca

SHA1
94ba65f999b4abd695ab3cb19b9bd30e2a788d65

SHA256
b924ba57b3755c9af95989fd22e736133cc71299c382d60f698a03e9c357e351

SHA512
a4f568a3ac5e71913436c301449d4d4714346ae955b04ea2d13a910cea4e98446bb2bd1c08aa0f73dd9e8a844ee943e9442f8ac801771919d3121d2b77cc952f

Download Submit
memory/2464-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2464-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2508-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2508-18-0x00000000025F0000-0x0000000002621000-memory.dmp

Filesize
196KB

Download
memory/2508-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2508-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2508-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2508-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2508-12-0x00000000025F0000-0x0000000002621000-memory.dmp

Filesize
196KB

Download
memory/2508-63-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2508-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2508-65-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2508-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2532-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2532-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-54-0x00000000024E0000-0x0000000002511000-memory.dmp

Filesize
196KB

Download
memory/2668-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2668-66-0x0000000002610000-0x0000000002641000-memory.dmp

Filesize
196KB

Download
memory/2904-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-21-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2904-37-0x0000000002830000-0x0000000002861000-memory.dmp

Filesize
196KB

Download
memory/2904-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download