redline | 45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0

General

Target

45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe
Size

1.6MB
MD5

6b0c7d583d810ad603b287c58ff72780
SHA1

04c71804468908033b7d8a4bca4805def97df8ce
SHA256

45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0
SHA512

f689f94400739f159fc7540ba6d14d5aff87a3dc10b6f1c7f33ab8739ff700853f9c657b8be05cbdec7254eb00ea8d900f1debf6bdfe4fa3d4ca83a666c625c8
SSDEEP

24576:LBhJX/5PpGEvqQmfM63Q1xlPVc1ZQBQkoTjPCpKTbzMxaZE7mdi9cqApEaikz:J/9C0Pyz6DMPCMTbzdZEmBqApykz

Score

10^/10

redline @nmrzv88 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@nmrzv88

C2

94.228.166.68:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/5548-8-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Loads dropped DLL 1 IoCs

pid	Process
2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe
5548	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5548	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 5548	2260	45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe	92

C:\Users\Admin\AppData\Local\Temp\45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\45a24ec4b4f6d18f63626f37f3c3d57203314d63bade072763ace0a44b54d2b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
426KB

MD5
255e1fde9837aaa6447b81fd0b8deadd

SHA1
2f6cb5f48d7ce6f41a0aba1658b9dba45573ae25

SHA256
42784ec150102e0402f71beaa2029ceea6404e95028e08b656ad71bf4a38d2ad

SHA512
2505861366c0d368d64c73c7ecf1130c28398a71e171d81524fc684034648908bfc5bb21ce8f621163f298f360db81bd37d8b2b6b16cce1e123c163becca8f83

Download Submit
memory/2260-12-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/2260-1-0x0000000000930000-0x0000000000AC6000-memory.dmp

Filesize
1.6MB

Download
memory/2260-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/2260-10-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-18-0x0000000008330000-0x000000000843A000-memory.dmp

Filesize
1.0MB

Download
memory/5548-20-0x0000000006A20000-0x0000000006A5C000-memory.dmp

Filesize
240KB

Download
memory/5548-13-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/5548-14-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/5548-15-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-16-0x0000000005660000-0x000000000566A000-memory.dmp

Filesize
40KB

Download
memory/5548-17-0x0000000006AB0000-0x00000000070C8000-memory.dmp

Filesize
6.1MB

Download
memory/5548-8-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5548-19-0x00000000068E0000-0x00000000068F2000-memory.dmp

Filesize
72KB

Download
memory/5548-11-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-21-0x0000000008540000-0x000000000858C000-memory.dmp

Filesize
304KB

Download
memory/5548-22-0x0000000009480000-0x00000000094E6000-memory.dmp

Filesize
408KB

Download
memory/5548-23-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-24-0x0000000009C20000-0x0000000009DE2000-memory.dmp

Filesize
1.8MB

Download
memory/5548-25-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-26-0x000000000A320000-0x000000000A84C000-memory.dmp

Filesize
5.2MB

Download
memory/5548-27-0x0000000006200000-0x0000000006250000-memory.dmp

Filesize
320KB

Download
memory/5548-28-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-30-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing