Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 23:17
Static task
static1
Behavioral task
behavioral1
Sample
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe
-
Size
3.4MB
-
MD5
38fd3cd96757c7a389a95d62f6c873c0
-
SHA1
cbe2f0f7346556354f0373749cfda56af149477d
-
SHA256
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719
-
SHA512
ecc1b0a0bf6634cae986af6d69c8b5819e53f8cc0e71d6c0bb66a215bd7d9566adbfdfa436c0c50d8ae37f1c5669fadca4faf029cabf5e76f54e2044ff85b773
-
SSDEEP
49152:J+ZT1GLmfGZrF3jW/dFnR04jrWThYLruUxftcWhkLvOV5Tk7oWCg+MovIduIH:J01lfGZpcjR05yruUbKMFW8W
Malware Config
Extracted
redline
Boobs
45.154.99.245:13799
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4528-21-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exeInstallUtil.exedescription pid process target process PID 2112 set thread context of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 set thread context of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 1612 set thread context of 32 1612 InstallUtil.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exeInstallUtil.exeInstallUtil.exeInstallUtil.exepid process 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe 1612 InstallUtil.exe 1612 InstallUtil.exe 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe 32 InstallUtil.exe 4528 InstallUtil.exe 4528 InstallUtil.exe 4528 InstallUtil.exe 4528 InstallUtil.exe 4528 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exeInstallUtil.exeInstallUtil.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 InstallUtil.exe Token: SeDebugPrivilege 32 InstallUtil.exe Token: SeBackupPrivilege 32 InstallUtil.exe Token: SeSecurityPrivilege 32 InstallUtil.exe Token: SeSecurityPrivilege 32 InstallUtil.exe Token: SeSecurityPrivilege 32 InstallUtil.exe Token: SeSecurityPrivilege 32 InstallUtil.exe Token: SeDebugPrivilege 4528 InstallUtil.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exeInstallUtil.exedescription pid process target process PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 1612 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 3364 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 2112 wrote to memory of 4528 2112 2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe PID 1612 wrote to memory of 32 1612 InstallUtil.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2270c0d549b1653768b307bd3f5b6c7dfab57217bda3fd99dbe2bb6534c0b719_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
memory/32-37-0x0000000009840000-0x000000000985E000-memory.dmpFilesize
120KB
-
memory/32-26-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/32-38-0x000000000A760000-0x000000000A922000-memory.dmpFilesize
1.8MB
-
memory/32-36-0x0000000009860000-0x00000000098D6000-memory.dmpFilesize
472KB
-
memory/32-35-0x0000000009530000-0x0000000009596000-memory.dmpFilesize
408KB
-
memory/32-39-0x000000000AE60000-0x000000000B38C000-memory.dmpFilesize
5.2MB
-
memory/1612-28-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1612-16-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1612-20-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1612-19-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1612-17-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/1612-12-0x0000000000400000-0x000000000060A000-memory.dmpFilesize
2.0MB
-
memory/1612-13-0x0000000000400000-0x000000000060A000-memory.dmpFilesize
2.0MB
-
memory/1612-15-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/2112-10-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/2112-4-0x0000000005A50000-0x0000000005AEC000-memory.dmpFilesize
624KB
-
memory/2112-11-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/2112-18-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/2112-0-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/2112-9-0x00000000031E0000-0x00000000031E6000-memory.dmpFilesize
24KB
-
memory/2112-1-0x00000000005D0000-0x000000000093E000-memory.dmpFilesize
3.4MB
-
memory/2112-23-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/2112-2-0x0000000005EC0000-0x0000000006464000-memory.dmpFilesize
5.6MB
-
memory/2112-3-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/2112-8-0x00000000087C0000-0x00000000087DA000-memory.dmpFilesize
104KB
-
memory/2112-7-0x0000000005B40000-0x0000000005B4A000-memory.dmpFilesize
40KB
-
memory/2112-6-0x00000000059B0000-0x00000000059F4000-memory.dmpFilesize
272KB
-
memory/2112-14-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/2112-5-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/4528-32-0x0000000005670000-0x0000000005682000-memory.dmpFilesize
72KB
-
memory/4528-33-0x00000000056D0000-0x000000000570C000-memory.dmpFilesize
240KB
-
memory/4528-34-0x0000000005710000-0x000000000575C000-memory.dmpFilesize
304KB
-
memory/4528-29-0x0000000006560000-0x0000000006B78000-memory.dmpFilesize
6.1MB
-
memory/4528-31-0x0000000005780000-0x000000000588A000-memory.dmpFilesize
1.0MB
-
memory/4528-25-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/4528-24-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/4528-21-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4528-40-0x000000000B650000-0x000000000B6A0000-memory.dmpFilesize
320KB
-
memory/4528-41-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB