Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 11:31
Static task
static1
Behavioral task
behavioral1
Sample
874f0118364b3b6a779c152eef6a80d0_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
874f0118364b3b6a779c152eef6a80d0_NEIKI.exe
-
Size
828KB
-
MD5
874f0118364b3b6a779c152eef6a80d0
-
SHA1
682a22a08a05b309bfe80a4894e93de0d892c6e3
-
SHA256
02c468753c3abc1ed70a55f0cdede5c47b32a80c068348be67471e5e1d88104c
-
SHA512
10670d9e51d3fff3c91facd3f6fa6bcf1d165156364134a77863626dfcb8a3dba6772dd8388d80417f6eb78598b9a6c689187e45f4f9470286bc23a0a0506642
-
SSDEEP
24576:Ny+vejioKutJaKLrDRqb8gA6butMvZxRPp:onjiohrrNo57F
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
resource yara_rule behavioral1/memory/3664-28-0x0000000004BB0000-0x0000000004BEC000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-30-0x0000000004D70000-0x0000000004DAA000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-36-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-40-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-38-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-78-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-58-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-34-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-32-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-31-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-94-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-92-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-90-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-88-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-86-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-84-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-82-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-80-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-76-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-74-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-72-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-70-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-68-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-66-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-64-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-62-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-60-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-56-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-54-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-52-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-50-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-48-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-46-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-44-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 behavioral1/memory/3664-42-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_zgrat_v1 -
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b78-19.dat healer behavioral1/memory/3928-22-0x0000000000AE0000-0x0000000000AEA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it103940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it103940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it103940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it103940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it103940.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it103940.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/3664-28-0x0000000004BB0000-0x0000000004BEC000-memory.dmp family_redline behavioral1/memory/3664-30-0x0000000004D70000-0x0000000004DAA000-memory.dmp family_redline behavioral1/memory/3664-36-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-40-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-38-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-78-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-58-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-34-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-32-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-31-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-94-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-92-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-90-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-88-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-86-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-84-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-82-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-80-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-76-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-74-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-72-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-70-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-68-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-66-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-64-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-62-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-60-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-56-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-54-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-52-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-50-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-48-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-46-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-44-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline behavioral1/memory/3664-42-0x0000000004D70000-0x0000000004DA5000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 4200 ziIv4739.exe 4696 ziLA8673.exe 3928 it103940.exe 3664 jr864246.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it103940.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 874f0118364b3b6a779c152eef6a80d0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziIv4739.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziLA8673.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5132 sc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3928 it103940.exe 3928 it103940.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3928 it103940.exe Token: SeDebugPrivilege 3664 jr864246.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3812 wrote to memory of 4200 3812 874f0118364b3b6a779c152eef6a80d0_NEIKI.exe 85 PID 3812 wrote to memory of 4200 3812 874f0118364b3b6a779c152eef6a80d0_NEIKI.exe 85 PID 3812 wrote to memory of 4200 3812 874f0118364b3b6a779c152eef6a80d0_NEIKI.exe 85 PID 4200 wrote to memory of 4696 4200 ziIv4739.exe 86 PID 4200 wrote to memory of 4696 4200 ziIv4739.exe 86 PID 4200 wrote to memory of 4696 4200 ziIv4739.exe 86 PID 4696 wrote to memory of 3928 4696 ziLA8673.exe 87 PID 4696 wrote to memory of 3928 4696 ziLA8673.exe 87 PID 4696 wrote to memory of 3664 4696 ziLA8673.exe 100 PID 4696 wrote to memory of 3664 4696 ziLA8673.exe 100 PID 4696 wrote to memory of 3664 4696 ziLA8673.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\874f0118364b3b6a779c152eef6a80d0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\874f0118364b3b6a779c152eef6a80d0_NEIKI.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIv4739.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIv4739.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziLA8673.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziLA8673.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it103940.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it103940.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr864246.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr864246.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:5132
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
569KB
MD517feb3afad0efee6aab136ccd8c250e4
SHA106bc48525277574cf76b349e083f763ed0c72899
SHA2562fdb5016813611d5bdd491db719e1acff659d2e478c7e90ba771f8839f60912b
SHA51255a7bf26249ca8ad1d23a5f0042c15c4423e8280db3e2d256c6e1cea23731866b48b92456dc6fe546286375b35be4e59e28d9a6c6da5089e85d03acff502c9c4
-
Filesize
414KB
MD551cc8128dc29b60dc03f025d3ffbdf43
SHA1278417f8c278948be77b92b7818c9548954927ab
SHA25664b8600e54f14c5ffb6157fdebe6976e30231ddd9545f04abe7d5af2b3c2b870
SHA5127a87c356d9409dc121de83108d066e4d45ce167c4fed5e2185f96ad4f27342fb94e2baa4516ae5ce46f67d14540d9b25483515736924fe5e2f0f5625ef4e8b55
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD51c661206e4eb1b3c18c0aae3bd437d65
SHA1e8d0389a26dc135ffb6a7a1d3123623c4e27ad4c
SHA2563fb2b4148736fd30269ed4ba333200d7cbf1bb892066fc88724b925dbad644f0
SHA512ae26d5ab87104b9e5407be6ba3659bdb0c46d53eda045250160cd2a795f29d5182cb04f50a5232f6e00b61cdb5b2c3f792f73ae45d1a5e24cbaa38880d9a006b