Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 00:05
Static task
static1
Behavioral task
behavioral1
Sample
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
-
Size
601KB
-
MD5
6d38f338629193941abbfd53130d01e0
-
SHA1
159a6d5f7b3282b8ed967b9bf9aa28402d5f75e5
-
SHA256
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3
-
SHA512
bc184be3a3ffbd5b2c9dc2b1c54037db794235ecdba89964fcf9b3b7fbd981fb7f2cc343488daa5df369b271263139cdd6be0f12ebbd7f5fa00114d07aeb7efe
-
SSDEEP
12288:HL+hE3tgGE7hbEjQch3aYoEx9aWstr08SaPN+HZGokR:kGahgrYpEXmr0YN+HZS
Malware Config
Extracted
redline
cheat
185.222.58.91:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2708 powershell.exe 2668 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exedescription pid process target process PID 2116 set thread context of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exepowershell.exepowershell.exepid process 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 2668 powershell.exe 2708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exepowershell.exepowershell.exe14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe Token: SeDebugPrivilege 2516 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exedescription pid process target process PID 2116 wrote to memory of 2708 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2708 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2708 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2708 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2668 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2668 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2668 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2668 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe powershell.exe PID 2116 wrote to memory of 2792 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe schtasks.exe PID 2116 wrote to memory of 2792 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe schtasks.exe PID 2116 wrote to memory of 2792 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe schtasks.exe PID 2116 wrote to memory of 2792 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe schtasks.exe PID 2116 wrote to memory of 2684 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2684 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2684 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2684 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe PID 2116 wrote to memory of 2516 2116 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lYrtmsGR.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lYrtmsGR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmpFilesize
1KB
MD56c633f104aa9f8123611be0c0c47dea4
SHA17cfb83ce4c4b5256b9223f3624a2c5c34d9cc5b7
SHA2562808383925943c4f4d8a7e04bb74696d357f5ee713a8b81c9d043b5ae77dbd98
SHA512f00b67e1279ddea1d63277b24107db9eaa74dd5368f18c8662440dddeba9dd5c1520ded9ecaa6dad1b1a1404fd4949089e6db74472753bd150ab2c42b9968c92
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD594baa69d00985a52953a861da5c243e4
SHA1ef2ef81243bc65433823164114ea32b471662201
SHA25699ef63638b1431b26fbec06338d7d63ff79c2e74c63102676bc5b4adc441eb6e
SHA512fdedfcfde9469ecde19a71e1a869e04316d4e23d9ba6ca0e08716757d66627e96dddd15cfe596152e56318272aa9e46d615ae1e97b42c2c0e3c9e4c5bf435e50
-
memory/2116-4-0x00000000006B0000-0x00000000006B8000-memory.dmpFilesize
32KB
-
memory/2116-31-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/2116-0-0x00000000748DE000-0x00000000748DF000-memory.dmpFilesize
4KB
-
memory/2116-5-0x00000000006C0000-0x00000000006CC000-memory.dmpFilesize
48KB
-
memory/2116-6-0x00000000042B0000-0x0000000004310000-memory.dmpFilesize
384KB
-
memory/2116-2-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/2116-1-0x0000000000070000-0x0000000000108000-memory.dmpFilesize
608KB
-
memory/2116-3-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/2516-19-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2516-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2516-21-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB