Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 14:43

General

  • Target

    62fe6dd851816191ccd2332046c6f8b0_NeikiAnalytics.exe

  • Size

    479KB

  • MD5

    62fe6dd851816191ccd2332046c6f8b0

  • SHA1

    1e443ea85f7d23b08506799e4a21aef98c958a23

  • SHA256

    e92c26af3d979e5cd6d43cf43142e8cdc471527eec1fc91086984c3aec018232

  • SHA512

    dc1833a0a2df22b0772fdd8fcd9333ab2d90c56f4ee74b586b6030210d26311b3f56cf735af3f58a9ba34faae6aa4fa4bf82bec4e46e169d48da4650f7b956cb

  • SSDEEP

    12288:NuWlMQGgJVtdW/sEzrWtHOw0iFauY/B/dEc0i3rALrbEcgYwuGggfcj:NuWlxJVtdW/sEzrWtHOw0iFauY/B/dEx

Score
10/10

Malware Config

Signatures

  • Malware Dropper & Backdoor - Berbew 1 IoCs

    Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62fe6dd851816191ccd2332046c6f8b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\62fe6dd851816191ccd2332046c6f8b0_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 396
      2⤵
      • Program crash
      PID:3388
    • C:\Users\Admin\AppData\Local\Temp\62fe6dd851816191ccd2332046c6f8b0_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\62fe6dd851816191ccd2332046c6f8b0_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 364
        3⤵
        • Program crash
        PID:2040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2876 -ip 2876
    1⤵
      PID:1512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1012 -ip 1012
      1⤵
        PID:1852

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\62fe6dd851816191ccd2332046c6f8b0_NeikiAnalytics.exe

              Filesize

              479KB

              MD5

              9e1d07d9649d620dc642cdc1d0174c69

              SHA1

              e1249a39484cc4109e0578a013aea917b551a2be

              SHA256

              9cd90f4555b292ece165b5a356839acf469f04187fcbbb248d2737d8dbb866df

              SHA512

              bc20de7a877227f2b1480e01bf9ee4db6fca9145fd9ce00a44533a4a6875d514b1fd345332c4b185af26b186821cca9f6a526329a47dc9b9ae8d356faffdb1a7

            • memory/1012-8-0x0000000000400000-0x0000000000437000-memory.dmp

              Filesize

              220KB

            • memory/1012-9-0x0000000000400000-0x000000000041A000-memory.dmp

              Filesize

              104KB

            • memory/1012-14-0x0000000004D90000-0x0000000004DC7000-memory.dmp

              Filesize

              220KB

            • memory/2876-0-0x0000000000400000-0x0000000000437000-memory.dmp

              Filesize

              220KB

            • memory/2876-7-0x0000000000400000-0x0000000000437000-memory.dmp

              Filesize

              220KB