redline | 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
Size

601KB
MD5

6d38f338629193941abbfd53130d01e0
SHA1

159a6d5f7b3282b8ed967b9bf9aa28402d5f75e5
SHA256

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3
SHA512

bc184be3a3ffbd5b2c9dc2b1c54037db794235ecdba89964fcf9b3b7fbd981fb7f2cc343488daa5df369b271263139cdd6be0f12ebbd7f5fa00114d07aeb7efe
SSDEEP

12288:HL+hE3tgGE7hbEjQch3aYoEx9aWstr08SaPN+HZGokR:kGahgrYpEXmr0YN+HZS

Score

10^/10

redline sectoprat cheat execution infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

185.222.58.91:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2708 powershell.exe
2668 powershell.exe

pid	process
2708	powershell.exe
2668	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

description	pid	process	target process
PID 2116 set thread context of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2792 schtasks.exe

pid	process
2792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exepowershell.exepowershell.exe

pid	process
2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
2668	powershell.exe
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exepowershell.exepowershell.exe14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2516	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

description	pid	process	target process
PID 2116 wrote to memory of 2708	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2708	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2708	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2708	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2668	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2668	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2668	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2668	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	powershell.exe
PID 2116 wrote to memory of 2792	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	schtasks.exe
PID 2116 wrote to memory of 2792	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	schtasks.exe
PID 2116 wrote to memory of 2792	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	schtasks.exe
PID 2116 wrote to memory of 2792	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	schtasks.exe
PID 2116 wrote to memory of 2684	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2684	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2684	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2684	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516	2116	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe	14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lYrtmsGR.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lYrtmsGR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"
2⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp
Filesize
1KB

MD5
6c633f104aa9f8123611be0c0c47dea4

SHA1
7cfb83ce4c4b5256b9223f3624a2c5c34d9cc5b7

SHA256
2808383925943c4f4d8a7e04bb74696d357f5ee713a8b81c9d043b5ae77dbd98

SHA512
f00b67e1279ddea1d63277b24107db9eaa74dd5368f18c8662440dddeba9dd5c1520ded9ecaa6dad1b1a1404fd4949089e6db74472753bd150ab2c42b9968c92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
94baa69d00985a52953a861da5c243e4

SHA1
ef2ef81243bc65433823164114ea32b471662201

SHA256
99ef63638b1431b26fbec06338d7d63ff79c2e74c63102676bc5b4adc441eb6e

SHA512
fdedfcfde9469ecde19a71e1a869e04316d4e23d9ba6ca0e08716757d66627e96dddd15cfe596152e56318272aa9e46d615ae1e97b42c2c0e3c9e4c5bf435e50

Download Submit
memory/2116-4-0x00000000006B0000-0x00000000006B8000-memory.dmp

Filesize
32KB

Download
memory/2116-31-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/2116-0-0x00000000748DE000-0x00000000748DF000-memory.dmp

Filesize
4KB

Download
memory/2116-5-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/2116-6-0x00000000042B0000-0x0000000004310000-memory.dmp

Filesize
384KB

Download
memory/2116-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/2116-1-0x0000000000070000-0x0000000000108000-memory.dmp

Filesize
608KB

Download
memory/2116-3-0x0000000000690000-0x00000000006A2000-memory.dmp

Filesize
72KB

Download
memory/2516-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2516-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2516-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download