7ed3ed2eda96a5f5d55266187d1bf12683fcb97b3a7c9b6d17fc67762f3d7371

Analysis

max time kernel
136s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Size 340KB
Sample240509-dpy4qsfc8x
SHA256 7ed3ed2eda96a5f5d55266187d1bf12683fcb97b3a7c9b6d17fc67762f3d7371
MD5 dad12eed121040c3b4524bae5f46a260
SHA1 39179ab2e01a1142ac5303fcf9c91df8435b2399
SHA512 8cd001a9dcdca3f90091b454c411546e065266b96bf9b74957e44b6530f1c8f0291fa44777e319e844171c9c4304dc523b35328c2fa94db70439c4e2842e890d
SSDEEP 6144:TGbasDTWgVIyedZwlNPjLs+H8rtMsQBJyJyymeH:TGmfyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe

Malware Dropper & Backdoor - Berbew 6 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0006000000022fa8-7.dat	family_berbew
behavioral2/files/0x0007000000023466-16.dat	family_berbew
behavioral2/files/0x0007000000023468-24.dat	family_berbew
behavioral2/files/0x000700000002346a-32.dat	family_berbew
behavioral2/files/0x000700000002346d-40.dat	family_berbew
behavioral2/files/0x000700000002346f-48.dat	family_berbew

Executes dropped EXE 6 IoCs

pid	Process
652	Njacpf32.exe
4012	Ncihikcg.exe
2128	Nkqpjidj.exe
3880	Nnolfdcn.exe
4104	Ncldnkae.exe
4280	Nkcmohbg.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3612	4280	WerFault.exe	87

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	dad12eed121040c3b4524bae5f46a260_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	dad12eed121040c3b4524bae5f46a260_NEIKI.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 652	1140	dad12eed121040c3b4524bae5f46a260_NEIKI.exe	82
PID 1140 wrote to memory of 652	1140	dad12eed121040c3b4524bae5f46a260_NEIKI.exe	82
PID 1140 wrote to memory of 652	1140	dad12eed121040c3b4524bae5f46a260_NEIKI.exe	82
PID 652 wrote to memory of 4012	652	Njacpf32.exe	83
PID 652 wrote to memory of 4012	652	Njacpf32.exe	83
PID 652 wrote to memory of 4012	652	Njacpf32.exe	83
PID 4012 wrote to memory of 2128	4012	Ncihikcg.exe	84
PID 4012 wrote to memory of 2128	4012	Ncihikcg.exe	84
PID 4012 wrote to memory of 2128	4012	Ncihikcg.exe	84
PID 2128 wrote to memory of 3880	2128	Nkqpjidj.exe	85
PID 2128 wrote to memory of 3880	2128	Nkqpjidj.exe	85
PID 2128 wrote to memory of 3880	2128	Nkqpjidj.exe	85
PID 3880 wrote to memory of 4104	3880	Nnolfdcn.exe	86
PID 3880 wrote to memory of 4104	3880	Nnolfdcn.exe	86
PID 3880 wrote to memory of 4104	3880	Nnolfdcn.exe	86
PID 4104 wrote to memory of 4280	4104	Ncldnkae.exe	87
PID 4104 wrote to memory of 4280	4104	Ncldnkae.exe	87
PID 4104 wrote to memory of 4280	4104	Ncldnkae.exe	87

C:\Users\Admin\AppData\Local\Temp\dad12eed121040c3b4524bae5f46a260_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\dad12eed121040c3b4524bae5f46a260_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\Njacpf32.exe
  C:\Windows\system32\Njacpf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\SysWOW64\Ncihikcg.exe
    C:\Windows\system32\Ncihikcg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\Nkqpjidj.exe
      C:\Windows\system32\Nkqpjidj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        7⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 400
        8⤵
        Program crash
        
        PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4280 -ip 4280
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 340KB
SHA256 9dd9466a27a55e3bdf3c3229d5e82550cf26afbe8a3a276bb386259947d025ff
MD5 0afddfa9686a37d3351204eb07f3680e
SHA1 e4dcd7f7406b617229df034aac3efd5400d005cc
SHA512 b642407a74c1b1db8487827e619833f30f0231766cc2466e7ac91312a357268af75664837dd98bc3c2a6c89ca8ed361bd47cab164ac262d14b98aa4527cbecbe
SSDEEP 6144:VGczrQSdCeIyedZwlNPjLs+H8rtMsQBJyJyymeH:xgyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 340KB
SHA256 74f56ed52ce7d0cab6df87f3eba76282e788c4a819dafd58350ccce4f6b9f7cb
MD5 011cf274ed9dea3c6e021c37f9c114dc
SHA1 3dd8b555dcd7fdbcd1831ecab1a40172687a2e0f
SHA512 13a6cc2558ff084939acbf68527e76cd1a00202ddd096489a47601691b838eddc5d240d69d67a652e48282f623e1696d6fa04a361cc6990501457328746e8efc
SSDEEP 6144:GUevXHUGXqEwIyedZwlNPjLs+H8rtMsQBJyJyymeH:je/HUUqwyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njacpf32.exe

Path C:\Windows\SysWOW64\Njacpf32.exe
Size 340KB
SHA256 420f863efed697faa02533c19269220598c29c0c2e5a9a91bcf7ca07ff4cbe0e
MD5 24bd33bfdf4ba2734f4ef3f25fadc671
SHA1 2e8375a94630ff6dd716e7adaf65e14dea6de8c0
SHA512 87896afb3457c5dbd0c5a520e3ec67b53538826823b00547533789757d7198b0650f820049a4fde54359c38914701b66f2903fc11bc6d76010f377f34d25bd50
SSDEEP 6144:57osyxvhRzIiGHIyedZwlNPjLs+H8rtMsQBJyJyymeH:57NyxvLzIilyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 340KB
SHA256 c20a3bd619b718d74027c94d70f3613ea13825f796a28b09dd45870b5554490c
MD5 2d203f841245b6cf8b0c3242e4fea48a
SHA1 72c732e7d856043813d983e63489094fb07e695c
SHA512 9e876ec64d27d62d672d87bd32ef568e66e39ae496624123d593d00dbeea266aed0c686661758913913255353031b378d265e0abaaa9bde2a9906b844212cb72
SSDEEP 6144:Vw4qgAIyedZwlNPjLs+H8rtMsQBJyJyymeH:G4vyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkqpjidj.exe

Path C:\Windows\SysWOW64\Nkqpjidj.exe
Size 340KB
SHA256 c0731c5e2c30945da64ee736818f26b89bcf889c2a909b4892ab25f146a7ad15
MD5 4ac7fe76a149dd4fedfbc3123f3f0ca2
SHA1 4c6a821d130c9d7bfdc6082ad5d38212a55149fd
SHA512 66ee2e3dd8bf7e25fa2438225a74447344dcb31025430c356d93dd14eab1005cbe85aad4c5465b24b5b2a5b42acb0a551f39669bc0a116fa9f65bb5435fd0237
SSDEEP 6144:kHwClK/NIyedZwlNPjLs+H8rtMsQBJyJyymeH:k3lFyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 340KB
SHA256 2d3dfa579ea13ee4f1394dccaef450ab3b92a2713d6c509dadee6cbe4773ff5b
MD5 a65844f01b17aa02cf4ba1441ad93c12
SHA1 f42d15e0d6f337dcbd8a91d1c317f91c0a0c4c0f
SHA512 9a357640403c7e85a8e614f81c4f794529111734af860e03d7274b8826a6837ea37a0d4c12005819491db891278abe6a777069336a10f15eb1e44400576a5fec
SSDEEP 6144:64HEa5IyedZwlNPjLs+H8rtMsQBJyJyymeH:iHyGZwlNPjLYRMsXJvmeH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-8-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/652-50-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1140-0-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1140-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/1140-51-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2128-29-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3880-37-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4012-21-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4104-45-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4280-49-0x0000000000400000-0x0000000000444000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads