a18041af60ad2ce3ea2e23a1e365fdf93f812e3a94ed6c5d99f63780671b2d05

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00fd130df6fdade18417d61bf1455b00_NEIKI.exe
Size

624KB
MD5

00fd130df6fdade18417d61bf1455b00
SHA1

45a1d25e8ef2a68dbf8d53d34dfea7850318facb
SHA256

a18041af60ad2ce3ea2e23a1e365fdf93f812e3a94ed6c5d99f63780671b2d05
SHA512

9fedfb5f62f0ee9d9a53e4d3cc51956931698714bbc39890a86f11367b043f7efc8f92d6ebf27e9a12ec8366f0513442835ece685208285cf403304a0f837a9b
SSDEEP

12288:IvFhHCtCLY3pN4vdIfNmYz2StCEb8/ZCiRsK+IjgPeAmzXMDDORh4R2IKIwM7jzf:IMCLY3ov6fgBENg/ZCiRsK+IjgPeAmzw

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000e000000023422-5.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
4652	00fd130df6fdade18417d61bf1455b00_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
4652	00fd130df6fdade18417d61bf1455b00_NEIKI.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1348	3132	WerFault.exe	79
1216	4652	WerFault.exe	87

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3132	00fd130df6fdade18417d61bf1455b00_NEIKI.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4652	00fd130df6fdade18417d61bf1455b00_NEIKI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4652	3132	00fd130df6fdade18417d61bf1455b00_NEIKI.exe	87
PID 3132 wrote to memory of 4652	3132	00fd130df6fdade18417d61bf1455b00_NEIKI.exe	87
PID 3132 wrote to memory of 4652	3132	00fd130df6fdade18417d61bf1455b00_NEIKI.exe	87

C:\Users\Admin\AppData\Local\Temp\00fd130df6fdade18417d61bf1455b00_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\00fd130df6fdade18417d61bf1455b00_NEIKI.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 396
  2⤵
  - Program crash
  PID:1348
- C:\Users\Admin\AppData\Local\Temp\00fd130df6fdade18417d61bf1455b00_NEIKI.exe
  C:\Users\Admin\AppData\Local\Temp\00fd130df6fdade18417d61bf1455b00_NEIKI.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 364
    3⤵
    - Program crash
    PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3132 -ip 3132
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4652 -ip 4652
1⤵
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00fd130df6fdade18417d61bf1455b00_NEIKI.exe

Filesize
624KB

MD5
0808852119118fa8337a9a78e35f1851

SHA1
167baf052a951c6f1cba65c54410fd10f0a27d47

SHA256
fd9637c680661062fea34744cd47ec965c5ea239e81010e859734ba311e3952a

SHA512
6cd27d97e63506928936a7ff97f879e145d7219853eb029de4e098627f2c670141804bf1939df6ad5c4e1596cd5ec9ccc3a36624153838db647fc63c79a79ec3

Download Submit
memory/3132-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3132-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4652-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4652-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4652-13-0x00000000014C0000-0x00000000014F8000-memory.dmp

Filesize
224KB

Download