2a695d24933483add379f6d553d1a6742eb05f7678f6714cee2d2c930558e912

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
Size

66KB
MD5

2595d6ebf78378d12a336c0b5ff44040
SHA1

3c4a6ee5ef4ebfbafcb96fcbd11e2b24a0a7bf79
SHA256

2a695d24933483add379f6d553d1a6742eb05f7678f6714cee2d2c930558e912
SHA512

2a1cf201597fd21968772d351fdbc9664e9781041afc443ce0fafa74059fbd4f90f5a1f9e5a1ddc1f42393714381eb137fa908a136062fddc40713564f6f32df
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXil:IeklMMYJhqezw/pXzH9il

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2628-55-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2632	explorer.exe
2756	spoolsv.exe
2628	svchost.exe
2568	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
2632	explorer.exe
2632	explorer.exe
2756	spoolsv.exe
2756	spoolsv.exe
2628	svchost.exe
2628	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2628	svchost.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2628	svchost.exe
2632	explorer.exe
2632	explorer.exe
2628	svchost.exe
2628	svchost.exe
2632	explorer.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2628	svchost.exe
2632	explorer.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe
2632	explorer.exe
2628	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2632	explorer.exe
2628	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
2632	explorer.exe
2632	explorer.exe
2756	spoolsv.exe
2756	spoolsv.exe
2628	svchost.exe
2628	svchost.exe
2568	spoolsv.exe
2568	spoolsv.exe
2632	explorer.exe
2632	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2632	2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2632	2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2632	2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2632	2148	2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe	28
PID 2632 wrote to memory of 2756	2632	explorer.exe	29
PID 2632 wrote to memory of 2756	2632	explorer.exe	29
PID 2632 wrote to memory of 2756	2632	explorer.exe	29
PID 2632 wrote to memory of 2756	2632	explorer.exe	29
PID 2756 wrote to memory of 2628	2756	spoolsv.exe	30
PID 2756 wrote to memory of 2628	2756	spoolsv.exe	30
PID 2756 wrote to memory of 2628	2756	spoolsv.exe	30
PID 2756 wrote to memory of 2628	2756	spoolsv.exe	30
PID 2628 wrote to memory of 2568	2628	svchost.exe	31
PID 2628 wrote to memory of 2568	2628	svchost.exe	31
PID 2628 wrote to memory of 2568	2628	svchost.exe	31
PID 2628 wrote to memory of 2568	2628	svchost.exe	31
PID 2628 wrote to memory of 2476	2628	svchost.exe	32
PID 2628 wrote to memory of 2476	2628	svchost.exe	32
PID 2628 wrote to memory of 2476	2628	svchost.exe	32
PID 2628 wrote to memory of 2476	2628	svchost.exe	32
PID 2628 wrote to memory of 1764	2628	svchost.exe	36
PID 2628 wrote to memory of 1764	2628	svchost.exe	36
PID 2628 wrote to memory of 1764	2628	svchost.exe	36
PID 2628 wrote to memory of 1764	2628	svchost.exe	36
PID 2628 wrote to memory of 2084	2628	svchost.exe	38
PID 2628 wrote to memory of 2084	2628	svchost.exe	38
PID 2628 wrote to memory of 2084	2628	svchost.exe	38
PID 2628 wrote to memory of 2084	2628	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2595d6ebf78378d12a336c0b5ff44040_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2476
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1764
    - - C:\Windows\SysWOW64\at.exe
        
        at 01:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
40ca56707cde2e17c287f6841011ab81

SHA1
ddd44a8cbb357da854fac6570da01fdb946a1256

SHA256
129de7b50f9c6c044457dcfe4b5ff66c2aa211abd060c1a77bb02a5803e26b65

SHA512
84be4e87a32a4beb1451cf4c0bd752126ba2f2b56b1249217214a5213f4f818e60d4357b2e83abff829fc3e8d2067d18c2f3bd5bd6d11c74a91be95ca6fd5c57

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
033dd759f62baf12520502b508997bf8

SHA1
de2d6917255c8caef3c6b220127f6edea5d1e36a

SHA256
4b9a9b2ec99c0aed2366b7826718863704fa4b62b565dba0303b950587e38e90

SHA512
1c369fe093860725bdce7bda0cba1437f7d7f04b434fe7f4cd13a524b31a7e7657c52d255e08450b3b39e1acdc12d698b0a25e57f9c46b1b095e4524ca95d97f

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
3663a4f87bee464f1a381d933695e7c3

SHA1
4b507deeb20a09c2e828a7405f053408d29dddbc

SHA256
39568b6b33ee282c06c26b445728b7ab17fd05d1a270459ce7082004b24590a3

SHA512
b4d6506d3f4e7c8e62349086f37256d69c7e4adf36d6f3d7dce8d40adde2c011049e70fe208d15f8b1e9a7ad7a794b8a1832c58c8bff10bf058b12333bc163aa

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
2358647e6d5d643bd39181b93cd39db0

SHA1
b9657b7c2207ab3c415e2c83c2dd0ef16875788d

SHA256
6c841464796b9e58ed5717a932ef454765915af38c88fd46fc7775570981ebce

SHA512
aa815afeb81f80b8732d508fa4a5e2418ca05b30e362f6f76232b565b13d42a3a41111b2adc6118b280b8b7a32418df6b2af41d2a39cb2fa9747666f3738f3d7

Download Submit
memory/2148-20-0x0000000002520000-0x0000000002551000-memory.dmp

Filesize
196KB

Download
memory/2148-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2148-19-0x0000000002520000-0x0000000002551000-memory.dmp

Filesize
196KB

Download
memory/2148-63-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2148-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2148-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2148-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2148-82-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2148-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2148-65-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2148-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2568-69-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2568-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2628-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2628-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2628-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2628-66-0x0000000001E30000-0x0000000001E61000-memory.dmp

Filesize
196KB

Download
memory/2632-35-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2632-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2632-36-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2632-17-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2632-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2632-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2632-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2756-53-0x00000000024F0000-0x0000000002521000-memory.dmp

Filesize
196KB

Download
memory/2756-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2756-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2756-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2756-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download