Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 06:45
Static task
static1
Behavioral task
behavioral1
Sample
7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe
-
Size
479KB
-
MD5
7903417a4425e5f819fdca4ddb5a4ae0
-
SHA1
42be90bb5600574abb0b37113b65b32d6388b7ff
-
SHA256
aee53fccee33b73dab9491356e6eb50d71b3b380ca589b649b6ec63ff792c3da
-
SHA512
11fff0808094ce693e9af5c1f3544f8efad57f5014959329a41d5d76ff92f9be45a3963b9307cfa829694d743f86b1c56f342b38f4f52d5f602339e5bca05fbf
-
SSDEEP
12288:qMrSy90q5EwvocAm820Gfl6pleAG/R/7hhVecnO:syMuocdMy8Hel/R/7hJO
Malware Config
Extracted
redline
divan
217.196.96.102:4132
-
auth_value
b414986bebd7f5a3ec9aee0341b8e769
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-15-0x0000000002460000-0x000000000247A000-memory.dmp healer behavioral1/memory/2012-18-0x0000000002630000-0x0000000002648000-memory.dmp healer behavioral1/memory/2012-47-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-45-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-43-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-41-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-39-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-37-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-35-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-33-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-31-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-29-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-27-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-25-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-23-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-21-0x0000000002630000-0x0000000002642000-memory.dmp healer behavioral1/memory/2012-20-0x0000000002630000-0x0000000002642000-memory.dmp healer -
Processes:
k8186776.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k8186776.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k8186776.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k8186776.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k8186776.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k8186776.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k8186776.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4676310.exe family_redline behavioral1/memory/3284-54-0x0000000000520000-0x000000000054E000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
y3225558.exek8186776.exel4676310.exepid process 4256 y3225558.exe 2012 k8186776.exe 3284 l4676310.exe -
Processes:
k8186776.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k8186776.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k8186776.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exey3225558.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3225558.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
k8186776.exepid process 2012 k8186776.exe 2012 k8186776.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
k8186776.exedescription pid process Token: SeDebugPrivilege 2012 k8186776.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exey3225558.exedescription pid process target process PID 2092 wrote to memory of 4256 2092 7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe y3225558.exe PID 2092 wrote to memory of 4256 2092 7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe y3225558.exe PID 2092 wrote to memory of 4256 2092 7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe y3225558.exe PID 4256 wrote to memory of 2012 4256 y3225558.exe k8186776.exe PID 4256 wrote to memory of 2012 4256 y3225558.exe k8186776.exe PID 4256 wrote to memory of 2012 4256 y3225558.exe k8186776.exe PID 4256 wrote to memory of 3284 4256 y3225558.exe l4676310.exe PID 4256 wrote to memory of 3284 4256 y3225558.exe l4676310.exe PID 4256 wrote to memory of 3284 4256 y3225558.exe l4676310.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7903417a4425e5f819fdca4ddb5a4ae0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3225558.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3225558.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8186776.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8186776.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4676310.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4676310.exe3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4744,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3225558.exeFilesize
307KB
MD54e3028d73450917c9d4202d11f59af5e
SHA19c454cfb375b12c6facdb030ca7a694a3361dd9e
SHA2569d5d42852e8fc887bdcdeb449a1a01182991239cc10c886cc2cccd626ad6091c
SHA5120b9b8192d02cc807a4ae129c358977b8c1c646309cdf0ca9d32562b68efd4f77c341d30e5027f0df802602d2156f8098bf9349c03afda31a443003bb4d28bdf7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8186776.exeFilesize
181KB
MD5d6a2a942efe90705be2ea8b373152592
SHA1ac53b99a209b41ff2dfd8557b5abd22443ebcc1f
SHA25626d09c7f5bb7eeaa5f1ceebdbf8092069a4957d25ce706e134db5533c35ba92f
SHA512a9024620f7165fba326bcd087435ffad0e65ec7dc010c74fc79a69119db47ad070efd8c8e58496711d56bda26d06cea4b89279e7fa2a9bfe3615292552104220
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4676310.exeFilesize
168KB
MD58a600b97912d60d7eefcb10006627b0a
SHA1eaf4f0a0415ed7d43aae737cf3e54fd5a8e0ce7d
SHA256ce85782c43c4f981523a26f465705bf3481afc481cdf85cc17a55d1c4e463ff8
SHA5125b33a53d0c7fda35fcc9c92d87819f7f83d0ce367b91cdca1a437fa5bc0354f1195d2d0044ae155ab4852ef600879442c57abf90481d5d43830891023302aa0b
-
memory/2012-31-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-17-0x0000000004B50000-0x00000000050F4000-memory.dmpFilesize
5.6MB
-
memory/2012-27-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-18-0x0000000002630000-0x0000000002648000-memory.dmpFilesize
96KB
-
memory/2012-19-0x0000000074430000-0x0000000074BE0000-memory.dmpFilesize
7.7MB
-
memory/2012-47-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-45-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-43-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-41-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-39-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-37-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-35-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-33-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-15-0x0000000002460000-0x000000000247A000-memory.dmpFilesize
104KB
-
memory/2012-29-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-16-0x0000000074430000-0x0000000074BE0000-memory.dmpFilesize
7.7MB
-
memory/2012-25-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-23-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-21-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-20-0x0000000002630000-0x0000000002642000-memory.dmpFilesize
72KB
-
memory/2012-48-0x0000000074430000-0x0000000074BE0000-memory.dmpFilesize
7.7MB
-
memory/2012-50-0x0000000074430000-0x0000000074BE0000-memory.dmpFilesize
7.7MB
-
memory/2012-14-0x000000007443E000-0x000000007443F000-memory.dmpFilesize
4KB
-
memory/3284-54-0x0000000000520000-0x000000000054E000-memory.dmpFilesize
184KB
-
memory/3284-55-0x00000000028A0000-0x00000000028A6000-memory.dmpFilesize
24KB
-
memory/3284-56-0x0000000005670000-0x0000000005C88000-memory.dmpFilesize
6.1MB
-
memory/3284-57-0x0000000005160000-0x000000000526A000-memory.dmpFilesize
1.0MB
-
memory/3284-58-0x0000000004ED0000-0x0000000004EE2000-memory.dmpFilesize
72KB
-
memory/3284-59-0x0000000005050000-0x000000000508C000-memory.dmpFilesize
240KB
-
memory/3284-60-0x0000000005090000-0x00000000050DC000-memory.dmpFilesize
304KB