ec588477b361e340564b7d4fa5a99f370de99b0fface02a787eeb35747543fb5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9decd54b365986dced2a2e926e36ea0_NEIKI.exe
Size 2.0MB
Sample240509-dm23lsfb8y
SHA256 ec588477b361e340564b7d4fa5a99f370de99b0fface02a787eeb35747543fb5
MD5 d9decd54b365986dced2a2e926e36ea0
SHA1 47a230122fc8392ea437ae571133670a85f819eb
SHA512 20795433c769ebadfedd2c735cfdc17c1d2fefecc306a51fbc6280af60d3b60b64d5fbb4e8f8f1e5db0359a6962c9149614ca208ec663102226c1cd9edac872d
SSDEEP 49152:4b93yn0HYjVnHX38ZVZEdmEYf/kQ+0dweXPbKP/9gbQY1U6Lf0u7dOD5i:W4hH83uwEY9+0dweXPbKP/9gbQY1U6Lt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000600000002326f-2.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
4428	52D3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4428	52D3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4428	2868	d9decd54b365986dced2a2e926e36ea0_NEIKI.exe	79
PID 2868 wrote to memory of 4428	2868	d9decd54b365986dced2a2e926e36ea0_NEIKI.exe	79
PID 2868 wrote to memory of 4428	2868	d9decd54b365986dced2a2e926e36ea0_NEIKI.exe	79

C:\Users\Admin\AppData\Local\Temp\d9decd54b365986dced2a2e926e36ea0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\d9decd54b365986dced2a2e926e36ea0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\52D3.tmp
  "C:\Users\Admin\AppData\Local\Temp\52D3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\d9decd54b365986dced2a2e926e36ea0_NEIKI.exe DC5503E99B31FBD5E36D25A9D87449217BAC4657093A322A7B1B3FA4284A95F847E216745D4CE429D0B490E27FD64313637BC6811D0AE5F58B4CB04236446799
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

52D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\52D3.tmp
Size 2.0MB
SHA256 2393f115699c745a77e72f86b3a8914847afd3e72a085f58489c07c7983e340d
MD5 caf953349498981501368dba221d9f97
SHA1 9b34ffcc13e493a811ce0a63f42b922ba050cec4
SHA512 d274563a967ce645af7dfeddef3da6199b2753af2bd8c14b80b0ecce64439a19c1536fed79598a8f8fd782e3554a33c6fb40b3adeb5f1a8896d5dd0b3027ba86
SSDEEP 49152:4b93yn0HYjVDrv59wCIz3H5SIturVJyWHkAXfweXPbKP/9gbQY1U6Lf0u7dOD5i:W4VLwCIz7tuVJyEPweXPbKP/9gbQY1Uo
MD5 SHA1 SHA512 SSDEEP

Submit Download