Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 00:04
Static task
static1
Behavioral task
behavioral1
Sample
3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
3b8a55a85d53ef8a61fa35cacff5d090
-
SHA1
423a8412bb8f66692b70cb428fab617648d0c1d5
-
SHA256
e0dc35a21928b205a548c0b36b8b4d3f4eb8b8e5185137d784d50f5dc1da6ae1
-
SHA512
a4f57bfc09515483da31613f19d1ea1a921a1c20740cac291c04789882fc83c37687cb9a3dbdab977f9f74cf7d07e58d3b36311c75219a8628cbba075eb66d6e
-
SSDEEP
24576:eyNaaSNlgnyzqGjqTThZ5gSHazMycERNPEc5M4e4:twaSeTz5tXycETTM4e
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4732-25-0x00000000025C0000-0x00000000025DA000-memory.dmp healer behavioral1/memory/4732-27-0x0000000004EE0000-0x0000000004EF8000-memory.dmp healer behavioral1/memory/4732-51-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-55-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-53-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-49-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-47-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-46-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-43-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-41-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-39-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-38-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-35-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-34-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-31-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-29-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer behavioral1/memory/4732-28-0x0000000004EE0000-0x0000000004EF2000-memory.dmp healer -
Processes:
122174453.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 122174453.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 122174453.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/592-63-0x0000000004C70000-0x0000000004CAC000-memory.dmp family_redline behavioral1/memory/592-64-0x0000000005460000-0x000000000549A000-memory.dmp family_redline behavioral1/memory/592-65-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-78-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-76-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-74-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-72-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-70-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-68-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-66-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-80-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-98-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-96-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-94-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-92-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-90-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-88-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-86-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-84-0x0000000005460000-0x0000000005495000-memory.dmp family_redline behavioral1/memory/592-82-0x0000000005460000-0x0000000005495000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zB017841.exeTM820372.exe122174453.exe200793949.exepid process 3184 zB017841.exe 956 TM820372.exe 4732 122174453.exe 592 200793949.exe -
Processes:
122174453.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 122174453.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exezB017841.exeTM820372.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zB017841.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" TM820372.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3552 4732 WerFault.exe 122174453.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
122174453.exepid process 4732 122174453.exe 4732 122174453.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
122174453.exe200793949.exedescription pid process Token: SeDebugPrivilege 4732 122174453.exe Token: SeDebugPrivilege 592 200793949.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exezB017841.exeTM820372.exedescription pid process target process PID 760 wrote to memory of 3184 760 3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe zB017841.exe PID 760 wrote to memory of 3184 760 3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe zB017841.exe PID 760 wrote to memory of 3184 760 3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe zB017841.exe PID 3184 wrote to memory of 956 3184 zB017841.exe TM820372.exe PID 3184 wrote to memory of 956 3184 zB017841.exe TM820372.exe PID 3184 wrote to memory of 956 3184 zB017841.exe TM820372.exe PID 956 wrote to memory of 4732 956 TM820372.exe 122174453.exe PID 956 wrote to memory of 4732 956 TM820372.exe 122174453.exe PID 956 wrote to memory of 4732 956 TM820372.exe 122174453.exe PID 956 wrote to memory of 592 956 TM820372.exe 200793949.exe PID 956 wrote to memory of 592 956 TM820372.exe 200793949.exe PID 956 wrote to memory of 592 956 TM820372.exe 200793949.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b8a55a85d53ef8a61fa35cacff5d090_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 10925⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4732 -ip 47321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exeFilesize
763KB
MD5f29d111c772c23c3f519a3a2fc3f08b6
SHA1268dc2b2e4f513d4413fad9368bc4e5d373e81eb
SHA2568051db68eba1bfc0d5b55749ddf5280b7070568597253ac8ea0e733184e0847e
SHA512f8a8524eb76e1a8e59c3d88b47f958c9f18b352cab81964bf899daff2bf363f56d14e87f3fde0e93a59ce721f3308cb036cac6b482a97227d5811f35f4818c8b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exeFilesize
592KB
MD50334faee3c8f458beda101583d670322
SHA1431c0120f423c32af37a40b2b03bf4ff2831efcd
SHA25666fbb89f1429d0fd5bb215cd30a3181c59dcc6553558b79367fc6d217f1f4ddb
SHA51280a4f2944ceb2962587b30aa258c257ce5fb5347d7e69ae6dfa0921a11086f1064b2421e9d46802852b596b412785935c7ad7639701ba8a0b94f7c27a8be0506
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exeFilesize
377KB
MD583f564c1ed3c578458a63a80a09e3133
SHA1f85f3afbdf8ef9240e9d62d663202e52649742de
SHA256c42d6dfe8ce27758b60ffab1d4111283fa33d0d0616b47ceacb9008470011ed0
SHA51217ca918909711c5d6c0b82844e9f34c2d1f174463ad6dd570e4fb86726917872f513fe8b19dc5e36adbbb0fe4fb911c6e22d3d7459a91a5e5befa10eeb4f12ef
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exeFilesize
459KB
MD5573ebefdb8312b08d981837af4379aa5
SHA1c4c2f5b56ed38c2bff5d35546fd9f269825f9e78
SHA256d499c5d2fbdc354790c269b27ab6c1be31368c93f386053415cb5877e47694e4
SHA51252d3014f63ad1b3c571a9df6a61a66f107c4dfc96d13c34d129907527dc29b03854a7dcf41295aad696692f430348b0109035026f24f25dfc3c03ecc41f0236a
-
memory/592-96-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-98-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-861-0x00000000025E0000-0x000000000262C000-memory.dmpFilesize
304KB
-
memory/592-860-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/592-859-0x0000000007FC0000-0x00000000080CA000-memory.dmpFilesize
1.0MB
-
memory/592-858-0x0000000004D00000-0x0000000004D12000-memory.dmpFilesize
72KB
-
memory/592-857-0x0000000007960000-0x0000000007F78000-memory.dmpFilesize
6.1MB
-
memory/592-63-0x0000000004C70000-0x0000000004CAC000-memory.dmpFilesize
240KB
-
memory/592-84-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-86-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-88-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-90-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-92-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-94-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-80-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-64-0x0000000005460000-0x000000000549A000-memory.dmpFilesize
232KB
-
memory/592-68-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-70-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-72-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-74-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-76-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-78-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-65-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-82-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/592-66-0x0000000005460000-0x0000000005495000-memory.dmpFilesize
212KB
-
memory/4732-27-0x0000000004EE0000-0x0000000004EF8000-memory.dmpFilesize
96KB
-
memory/4732-24-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4732-38-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-28-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-29-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-31-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-34-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-35-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-23-0x00000000008F0000-0x000000000091D000-memory.dmpFilesize
180KB
-
memory/4732-41-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-58-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4732-57-0x0000000000400000-0x0000000000803000-memory.dmpFilesize
4.0MB
-
memory/4732-25-0x00000000025C0000-0x00000000025DA000-memory.dmpFilesize
104KB
-
memory/4732-39-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-46-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-47-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-49-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-53-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-55-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-51-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/4732-22-0x0000000000930000-0x0000000000A30000-memory.dmpFilesize
1024KB
-
memory/4732-26-0x0000000004FE0000-0x0000000005584000-memory.dmpFilesize
5.6MB
-
memory/4732-43-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB