redline | c5080c1bbbf8ab6e4e90933a636ffc3bd501fa5fbde29165acb095369ad9ef65

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 08:41

Target

b8dd8d38d6efc76f80b7b6dabee6b930_NeikiAnalytics.exe
Size

95KB
MD5

b8dd8d38d6efc76f80b7b6dabee6b930
SHA1

a8b125ca9fe69cad115cb3f3a902894c50412af0
SHA256

c5080c1bbbf8ab6e4e90933a636ffc3bd501fa5fbde29165acb095369ad9ef65
SHA512

e23cb8ebc423153488a610baf8fa8b07dd4ea28602a93fe6ae4cc65af8e30ff098642b7ff4cb9a19373834dbcb527385974eebbb4dc31b403766963703afa813
SSDEEP

1536:iqscPqBezlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2LteulgS6p4:AumeZYk+zi0ZbYe1g0ujyzdH4

Score

10^/10

Family

redline

Botnet

cheat123

34.123.187.87:4483

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4060-1-0x00000000008F0000-0x000000000090E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4060-1-0x00000000008F0000-0x000000000090E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b8dd8d38d6efc76f80b7b6dabee6b930_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 4060 b8dd8d38d6efc76f80b7b6dabee6b930_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	4060	b8dd8d38d6efc76f80b7b6dabee6b930_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\b8dd8d38d6efc76f80b7b6dabee6b930_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b8dd8d38d6efc76f80b7b6dabee6b930_NeikiAnalytics.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1152

memory/4060-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/4060-1-0x00000000008F0000-0x000000000090E000-memory.dmp

Filesize
120KB

Download
memory/4060-2-0x00000000058D0000-0x0000000005E74000-memory.dmp

Filesize
5.6MB

Download
memory/4060-3-0x00000000064A0000-0x0000000006AB8000-memory.dmp

Filesize
6.1MB

Download
memory/4060-4-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/4060-5-0x0000000005420000-0x0000000005432000-memory.dmp

Filesize
72KB

Download
memory/4060-6-0x0000000005560000-0x000000000559C000-memory.dmp

Filesize
240KB

Download
memory/4060-7-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4060-8-0x0000000006310000-0x000000000635C000-memory.dmp

Filesize
304KB

Download
memory/4060-9-0x0000000007D20000-0x0000000007E2A000-memory.dmp

Filesize
1.0MB

Download
memory/4060-10-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/4060-11-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download