redline | c2602b52ded3f627cf95cba8ce73cb7c87d0801e311ecc89d76f581a88de6a66

General

Target

58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe
Size

288KB
MD5

58f18d547d87c9580e136ef3b0a6d030
SHA1

9ad5ad8aea39845475a8bb2b1210733207d9c744
SHA256

c2602b52ded3f627cf95cba8ce73cb7c87d0801e311ecc89d76f581a88de6a66
SHA512

fe94bf0c59b34e54ca7291fd202b44dcd03e9fb9901410e02daa42b49329f41e4b39d6624ad2945c8213a9937f247dce27b0e2c6388647b2d9b84ac7cb6b2163
SSDEEP

6144:CFwObbLaRweYyiBodebbws/X3T3pW/z6om1elSOsJucBllIyZq:wb+R1fe4sv1Wb6od0OsU2Xq

Score

10^/10

redline zgrat discovery infostealer rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/228-4-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/228-4-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
228	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84
PID 5024 wrote to memory of 228	5024	58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\58f18d547d87c9580e136ef3b0a6d030_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/228-14-0x00000000062F0000-0x00000000063FA000-memory.dmp

Filesize
1.0MB

Download
memory/228-27-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/228-16-0x0000000006280000-0x00000000062BC000-memory.dmp

Filesize
240KB

Download
memory/228-25-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/228-8-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/228-9-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/228-10-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/228-11-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/228-12-0x0000000005170000-0x000000000517A000-memory.dmp

Filesize
40KB

Download
memory/228-15-0x0000000006220000-0x0000000006232000-memory.dmp

Filesize
72KB

Download
memory/228-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/228-24-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/228-13-0x0000000006790000-0x0000000006DA8000-memory.dmp

Filesize
6.1MB

Download
memory/228-17-0x0000000006400000-0x000000000644C000-memory.dmp

Filesize
304KB

Download
memory/228-18-0x0000000006580000-0x00000000065E6000-memory.dmp

Filesize
408KB

Download
memory/228-19-0x0000000006F30000-0x0000000006FA6000-memory.dmp

Filesize
472KB

Download
memory/228-20-0x0000000006760000-0x000000000677E000-memory.dmp

Filesize
120KB

Download
memory/228-21-0x0000000008570000-0x0000000008732000-memory.dmp

Filesize
1.8MB

Download
memory/228-22-0x0000000008C70000-0x000000000919C000-memory.dmp

Filesize
5.2MB

Download
memory/5024-23-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/5024-1-0x0000000000010000-0x000000000005C000-memory.dmp

Filesize
304KB

Download
memory/5024-7-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/5024-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing