Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
14-05-2024 17:14
General
-
Target
ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe
-
Size
593KB
-
MD5
ceeb4befaf7e9d80afc9c6dee12b6310
-
SHA1
e260dd80b10d44d0522226c207c43748b859122b
-
SHA256
2c01e17d41a4593f93f10f51a6f06e99b5858a94bf07ef143ffc6dd758a1a8aa
-
SHA512
d7c1a9acd472c99fed274c7bdcee37aaa3943af1ebc8c5a105b4edbfd6e4c9f807542b592aecfa52d5ab45686977e95a0ee33b8db39e1bd6e4389339bf259d85
-
SSDEEP
12288:gy90kukXimYvUW1k1wSTk06Jl54PNPURSFQkD:gyckT5ek1wSTfM4NPCSFQI
Malware Config
Signatures
-
Detect ZGRat V1 20 IoCs
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\45953239.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\45953239.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 9683⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk259606.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk259606.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4280 -ip 42801⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD554e8e25f5398e5bcc4f3ba6a8ca83f8b
SHA1074cde6f42aa8a98fcca9ff63303617bf012a87b
SHA2569bcf3935cf9780f5ec38d09e08f82737aa0e7bb587615f35fb3099c36e95230d
SHA5128a714d1d632cc3178d0785bd361f3845be224aa7b87258a46467c858c0c1ec20196ce329a984bc8a30a3b0445449b679de853c5e5ba0a35824c22b1d6afb1747
-
Filesize
459KB
MD521f612126ff1ba55c0a232ee639832b9
SHA17159c50575e311f5cd287703e09d8d3a6847b12f
SHA25694141402770301535736e7886f3710f4ec1afd6d14a31fec73b9b819d9c1ddf9
SHA512a5e8728066d61331d82eb0cf8cd50c60261b11b5564ca46a42cdc6e1e6be04147c0e317b74877fb608dcb907acd551e4e22dfe8d97f7bed20657417811583916
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
4.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
5.6MB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
4.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
104KB