Analysis
-
max time kernel
129s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 16:38
Static task
static1
Behavioral task
behavioral1
Sample
057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe
-
Size
795KB
-
MD5
3ff70660ba6803338c83249ef161cc10
-
SHA1
56fba5e6baabe26aa8193089637f0f6c3d51398c
-
SHA256
057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4
-
SHA512
44c406fce4f20dc099986a03d36124f85b054aa39c45a87d1cf22d3679e2e31f0a420803b8dd9a11a270b71351615f151ad59b0078b48eb43bb37f53e916d448
-
SSDEEP
12288:bCf0rGLDrU1qBBuE+juhnS6/fRRC1EfUcKoLBnym1gjECDETjIm52k6Ek/r:bCdL4E+j8SmRRUEfVLByVECD8jf6T
Malware Config
Extracted
redline
cheat
185.222.58.70:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4504-49-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4504-49-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2268 powershell.exe 1528 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exePO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation PO.exe -
Executes dropped EXE 3 IoCs
Processes:
PO.exePO.exePO.exepid process 3708 PO.exe 3192 PO.exe 4504 PO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 3708 set thread context of 4504 3708 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
PO.exepowershell.exepowershell.exepid process 3708 PO.exe 3708 PO.exe 3708 PO.exe 2268 powershell.exe 3708 PO.exe 3708 PO.exe 1528 powershell.exe 3708 PO.exe 2268 powershell.exe 1528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 3708 PO.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeDebugPrivilege 4504 PO.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exePO.exedescription pid process target process PID 1340 wrote to memory of 3708 1340 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe PO.exe PID 1340 wrote to memory of 3708 1340 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe PO.exe PID 1340 wrote to memory of 3708 1340 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe PO.exe PID 3708 wrote to memory of 2268 3708 PO.exe powershell.exe PID 3708 wrote to memory of 2268 3708 PO.exe powershell.exe PID 3708 wrote to memory of 2268 3708 PO.exe powershell.exe PID 3708 wrote to memory of 1528 3708 PO.exe powershell.exe PID 3708 wrote to memory of 1528 3708 PO.exe powershell.exe PID 3708 wrote to memory of 1528 3708 PO.exe powershell.exe PID 3708 wrote to memory of 3128 3708 PO.exe schtasks.exe PID 3708 wrote to memory of 3128 3708 PO.exe schtasks.exe PID 3708 wrote to memory of 3128 3708 PO.exe schtasks.exe PID 3708 wrote to memory of 3192 3708 PO.exe PO.exe PID 3708 wrote to memory of 3192 3708 PO.exe PO.exe PID 3708 wrote to memory of 3192 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe PID 3708 wrote to memory of 4504 3708 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DRIaUJaxClxFyS.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DRIaUJaxClxFyS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA325.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.logFilesize
1KB
MD56f8f3a9a57cb30e686d3355e656031e0
SHA1acccd6befb1a2f40e662280bc5182e086a0d079b
SHA256283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea
SHA5128f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5875aa62e33c7c6afa3ce3cc5d2741122
SHA100bbb4c4c7b8812226f0a83ea9fa41539af94f70
SHA2561004f6f21caa2ee7e6c89d226f977e7494d61f824913d97f76d0cebdc8e0ebfe
SHA512974b47976f0188c56f7cdbbbc27a9c6feead7a023e9fafee3998f6ffd5c9ba35748f0d42367adce1ae75823c5fdff0159a8561e7a33030ce33efafc5437b30d5
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
507KB
MD501403de5e5b173a6459964ebc76ea44c
SHA1e0e0badffcd445fb5a9940d5d9894f9faf2d3c15
SHA256c97a7970e247697ee931d61c10242a1f0f2b24d4e8ef784b26e7b8409ae13131
SHA512497a95bc5175c83c2346b9359af4ffae020fdfc5adab9d1aa3df11e59bc53f8f6e830e3fe4a9a62d912242923dc9ace81390ecec0425b7d64538b5e07507b950
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tivimxz4.ttk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpA325.tmpFilesize
1KB
MD51568e4e16caf22d596a96a6b8433cdc4
SHA185edbe1f2278c28961ec0671f13bece2bfe81b76
SHA2565f75d8261cd81c031ae3d8fada92c4bcce3c39d585fb4f2a52263df45eb3ac9b
SHA5127092a5cca62637613493ff6f0aa615db91396c15ba23fb9db12e41ffc2cae20382353031de55e35667794b6378800652ed29fc939f5d517b5d56e9df66c25eb0
-
memory/1528-81-0x000000006FE90000-0x000000006FEDC000-memory.dmpFilesize
304KB
-
memory/1528-92-0x0000000007940000-0x0000000007FBA000-memory.dmpFilesize
6.5MB
-
memory/1528-100-0x0000000007620000-0x0000000007628000-memory.dmpFilesize
32KB
-
memory/1528-97-0x0000000007530000-0x000000000753E000-memory.dmpFilesize
56KB
-
memory/1528-96-0x0000000007500000-0x0000000007511000-memory.dmpFilesize
68KB
-
memory/1528-94-0x0000000007370000-0x000000000737A000-memory.dmpFilesize
40KB
-
memory/2268-93-0x0000000006D90000-0x0000000006DAA000-memory.dmpFilesize
104KB
-
memory/2268-67-0x0000000005A60000-0x0000000005A7E000-memory.dmpFilesize
120KB
-
memory/2268-32-0x0000000002150000-0x0000000002186000-memory.dmpFilesize
216KB
-
memory/2268-33-0x0000000004CF0000-0x0000000005318000-memory.dmpFilesize
6.2MB
-
memory/2268-34-0x0000000004AC0000-0x0000000004AE2000-memory.dmpFilesize
136KB
-
memory/2268-40-0x0000000004C60000-0x0000000004CC6000-memory.dmpFilesize
408KB
-
memory/2268-41-0x0000000005420000-0x0000000005486000-memory.dmpFilesize
408KB
-
memory/2268-99-0x00000000070D0000-0x00000000070EA000-memory.dmpFilesize
104KB
-
memory/2268-98-0x0000000006FD0000-0x0000000006FE4000-memory.dmpFilesize
80KB
-
memory/2268-47-0x0000000005490000-0x00000000057E4000-memory.dmpFilesize
3.3MB
-
memory/2268-95-0x0000000007010000-0x00000000070A6000-memory.dmpFilesize
600KB
-
memory/2268-82-0x0000000006C60000-0x0000000006D03000-memory.dmpFilesize
652KB
-
memory/2268-80-0x0000000006050000-0x000000000606E000-memory.dmpFilesize
120KB
-
memory/2268-69-0x0000000006A20000-0x0000000006A52000-memory.dmpFilesize
200KB
-
memory/2268-70-0x000000006FE90000-0x000000006FEDC000-memory.dmpFilesize
304KB
-
memory/3708-18-0x0000000004CF0000-0x0000000004CFA000-memory.dmpFilesize
40KB
-
memory/3708-24-0x0000000006B00000-0x0000000006B08000-memory.dmpFilesize
32KB
-
memory/3708-20-0x0000000005BC0000-0x00000000060EC000-memory.dmpFilesize
5.2MB
-
memory/3708-16-0x00000000050E0000-0x0000000005684000-memory.dmpFilesize
5.6MB
-
memory/3708-15-0x00000000001D0000-0x0000000000250000-memory.dmpFilesize
512KB
-
memory/3708-26-0x0000000006D70000-0x0000000006DD0000-memory.dmpFilesize
384KB
-
memory/3708-53-0x0000000072790000-0x0000000072F40000-memory.dmpFilesize
7.7MB
-
memory/3708-21-0x0000000004F90000-0x000000000502C000-memory.dmpFilesize
624KB
-
memory/3708-14-0x000000007279E000-0x000000007279F000-memory.dmpFilesize
4KB
-
memory/3708-22-0x0000000005030000-0x00000000050A6000-memory.dmpFilesize
472KB
-
memory/3708-17-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/3708-25-0x0000000006B10000-0x0000000006B1C000-memory.dmpFilesize
48KB
-
memory/3708-19-0x0000000072790000-0x0000000072F40000-memory.dmpFilesize
7.7MB
-
memory/3708-23-0x0000000005790000-0x00000000057A2000-memory.dmpFilesize
72KB
-
memory/4504-66-0x0000000005100000-0x000000000514C000-memory.dmpFilesize
304KB
-
memory/4504-65-0x00000000050C0000-0x00000000050FC000-memory.dmpFilesize
240KB
-
memory/4504-49-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4504-54-0x0000000005580000-0x0000000005B98000-memory.dmpFilesize
6.1MB
-
memory/4504-64-0x0000000005060000-0x0000000005072000-memory.dmpFilesize
72KB
-
memory/4504-68-0x0000000005350000-0x000000000545A000-memory.dmpFilesize
1.0MB