9813d92c724909fb90125f5a71bf3b220d34c3485e7712fa419907d436cd78c6

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
Size

66KB
MD5

3490ce781b5a7e105c10665ca67e13a0
SHA1

432c8eba37cdf07473196a3d3d99f8fa5f30b922
SHA256

9813d92c724909fb90125f5a71bf3b220d34c3485e7712fa419907d436cd78c6
SHA512

a3e02dd25504831a23e6cc9c6bbc620d5dfde46f8fafed719b467408cde88ef88bc36cf607b9b3f4d6951a1ecd1e1de39d11cc579bfc7cd95852ddc6898d8c6f
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiN:IeklMMYJhqezw/pXzH9iN

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2484-57-0x0000000072940000-0x0000000072A93000-memory.dmp	BazaLoader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1540	explorer.exe
2692	spoolsv.exe
2484	svchost.exe
2448	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
1540	explorer.exe
1540	explorer.exe
2692	spoolsv.exe
2692	spoolsv.exe
2484	svchost.exe
2484	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
1540	explorer.exe
2484	svchost.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe
2484	svchost.exe
1540	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1540	explorer.exe
2484	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
1540	explorer.exe
1540	explorer.exe
2692	spoolsv.exe
2692	spoolsv.exe
2484	svchost.exe
2484	svchost.exe
2448	spoolsv.exe
2448	spoolsv.exe
1540	explorer.exe
1540	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1540	2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe	28
PID 2740 wrote to memory of 1540	2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe	28
PID 2740 wrote to memory of 1540	2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe	28
PID 2740 wrote to memory of 1540	2740	3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe	28
PID 1540 wrote to memory of 2692	1540	explorer.exe	29
PID 1540 wrote to memory of 2692	1540	explorer.exe	29
PID 1540 wrote to memory of 2692	1540	explorer.exe	29
PID 1540 wrote to memory of 2692	1540	explorer.exe	29
PID 2692 wrote to memory of 2484	2692	spoolsv.exe	30
PID 2692 wrote to memory of 2484	2692	spoolsv.exe	30
PID 2692 wrote to memory of 2484	2692	spoolsv.exe	30
PID 2692 wrote to memory of 2484	2692	spoolsv.exe	30
PID 2484 wrote to memory of 2448	2484	svchost.exe	31
PID 2484 wrote to memory of 2448	2484	svchost.exe	31
PID 2484 wrote to memory of 2448	2484	svchost.exe	31
PID 2484 wrote to memory of 2448	2484	svchost.exe	31
PID 2484 wrote to memory of 2224	2484	svchost.exe	32
PID 2484 wrote to memory of 2224	2484	svchost.exe	32
PID 2484 wrote to memory of 2224	2484	svchost.exe	32
PID 2484 wrote to memory of 2224	2484	svchost.exe	32
PID 2484 wrote to memory of 1448	2484	svchost.exe	36
PID 2484 wrote to memory of 1448	2484	svchost.exe	36
PID 2484 wrote to memory of 1448	2484	svchost.exe	36
PID 2484 wrote to memory of 1448	2484	svchost.exe	36
PID 2484 wrote to memory of 1644	2484	svchost.exe	38
PID 2484 wrote to memory of 1644	2484	svchost.exe	38
PID 2484 wrote to memory of 1644	2484	svchost.exe	38
PID 2484 wrote to memory of 1644	2484	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3490ce781b5a7e105c10665ca67e13a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1540
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2224
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1448
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
089e5dbfa4be0ae6a38eae6b6c29f5a7

SHA1
21b8bf4886eb9f880d4529673bb6d39cfeabbfeb

SHA256
45fe1aa65d866d7b581c6ed3f94e1b5e8cea9dbea7c57e4306aaa819a390639e

SHA512
990e7f795426dd745cbe2fea1a2b2102c2e69437ad34a2e9c5568a113402cfa01d9deaab3197ddd9f8f9b4a6f08e111a847f9a518df34a2826b5aa7090be0981

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
66KB

MD5
92e132d370e08bf5d8706a851406822e

SHA1
cdd74077f55e6d56119f64b9967f4e1071fae1b3

SHA256
e096bd0600e7003827de78df5597b65a0afb27e6a40d8f16e7151dc0e3d19b33

SHA512
f3b48b79586dcd08a5998a8078473d897e525ba52f31e2d9ffbe139a186f91ac101429d3364b17cb6cecc5fc9df72bba68b7583da685fa439a2987da21465d1b

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
f14273f734918c24b654d4792c132c37

SHA1
740c93dbb996814c7f02b9408c94d535c8617d89

SHA256
ab1dcc27ef7c17c33b9d031132c15563603e5918ee4821c012831a3a8c7c47c7

SHA512
71d5a020db57b6b0162b2ef91616390e0b888fc512d6239668f0dc1d6f29b66f319383c628369fdff820d03e55d013c297c26f4a6d96f937ffac10af9ee75a35

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
5f8da99d0af3fd0e023bcaa3c5a61510

SHA1
e029ed5f74f2c096f412647ad6fd3254c7326ddc

SHA256
2d6f8df01f8e6ccdd751de09aff1fcc5d0745bf520f7f112a71720324645e51e

SHA512
f892d6bbf8d237ce0a4205437c992459dbb36ee409f06ee94b4795e32bb394e5b4c2d494783739b073bb71c5ab21805a7326b8640ec21b744bf72c26ce995937

Download Submit
memory/1540-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1540-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1540-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1540-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1540-37-0x0000000001D80000-0x0000000001DB1000-memory.dmp

Filesize
196KB

Download
memory/1540-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1540-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1540-94-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-69-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2448-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2484-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-85-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2692-44-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2692-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2692-56-0x00000000025D0000-0x0000000002601000-memory.dmp

Filesize
196KB

Download
memory/2692-38-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2692-39-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2740-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2740-55-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2740-62-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2740-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2740-16-0x00000000004F0000-0x0000000000521000-memory.dmp

Filesize
196KB

Download
memory/2740-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2740-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2740-17-0x00000000004F0000-0x0000000000521000-memory.dmp

Filesize
196KB

Download
memory/2740-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2740-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2740-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download