Analysis
- max time kernel
149s - max time network
154s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
09/05/2024, 22:40
General
- Target 13cccb19332edc17ab4556e6926a7d50_NeikiAnalytics.exe
- Size 361KB
- Sample240509-2lwffaea53
- SHA256 9658029f65ab4cb80f29f7d9c7787488673cb5a62478e0e3d72fc60bc9437062
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13cccb19332edc17ab4556e6926a7d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\13cccb19332edc17ab4556e6926a7d50_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2008-3-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2008-2-0x0000000000220000-0x0000000000266000-memory.dmp
memory/2008-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmp
memory/2008-4-0x00000000046A0000-0x00000000046DC000-memory.dmp
memory/2008-5-0x0000000004740000-0x000000000477A000-memory.dmp
memory/2008-23-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-45-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-65-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-63-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-67-0x0000000000400000-0x0000000002BC3000-memory.dmp
memory/2008-70-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-68-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-61-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-59-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-57-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-55-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-53-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-51-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-49-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-47-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-43-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-41-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-39-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-37-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-35-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-33-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-31-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-29-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-27-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-25-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-21-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-19-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-17-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-15-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-13-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-11-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-9-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-7-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-6-0x0000000004740000-0x0000000004775000-memory.dmp
memory/2008-800-0x0000000002CF0000-0x0000000002DF0000-memory.dmp