nerbian | 6472c43fe2a28b258625ac21891ba5ac60894abaf6e6e2af3a18a6380b9287f0 | Triage

Analysis

max time kernel
97s
max time network
175s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
26-07-2022 00:00

Sharing

Report Analysis Logs

General

Target

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82.exe
Size

4.1MB
MD5

92c314b7692cb2b64512750ad7b3d1b4
SHA1

a9a80722656e7a40fac99cc7eca2956e234e70c2
SHA256

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82
SHA512

5bb574b1651d4513b3c1e472861ec8b5ef12decab195affa0d5fa7ce4e8e4fa7c4fb0f79aad0676adc31f1fbac6a3eae3a2eb798137e8357e81cd700f15c2668

Score

10^/10

nerbian rat trojan upx

Malware Config

Signatures

Detect Nerbian RAT malware 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1764-54-0x0000000000EC0000-0x00000000016C7000-memory.dmp	family_nerbian
behavioral1/memory/1764-55-0x0000000000EC0000-0x00000000016C7000-memory.dmp	family_nerbian

Nerbian
Remote access trojan written in the Golang.
rat trojan nerbian

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1764-54-0x0000000000EC0000-0x00000000016C7000-memory.dmp	upx
behavioral1/memory/1764-55-0x0000000000EC0000-0x00000000016C7000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82.exe
"C:\Users\Admin\AppData\Local\Temp\011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82.exe"
1⤵
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-54-0x0000000000EC0000-0x00000000016C7000-memory.dmp

Filesize
8.0MB

Download
memory/1764-55-0x0000000000EC0000-0x00000000016C7000-memory.dmp

Filesize
8.0MB

Download