Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 14:13
Behavioral task
behavioral1
Sample
57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe
-
Size
960KB
-
MD5
57253ea6c3d290a72ed2b861efb1e320
-
SHA1
f1a2739c4683356c700aa75e446612f85ad3cc0d
-
SHA256
ea7dc678eb5e1b60662eac77e0ff06d4d6acf9bc2e00d333731f1d12ea71edd2
-
SHA512
d5a589b401f55922104691ea595ea7682f727d9c4426aa021e903ad7989b6a1b4573348e524c696f14fd8a0242fde415307df27e83aa99137c2db69eecaebeb4
-
SSDEEP
24576:6aOjAhNbvoulyxKxGLZmN1VUZm8k3uql6lrdU7Qwi:6aOshBvfG3ZmXiZm8k3uql6lrdU7Qwi
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000d00000001340c-1.dat family_berbew -
Deletes itself 1 IoCs
pid Process 2696 EA1.tmp -
Executes dropped EXE 1 IoCs
pid Process 2696 EA1.tmp -
Loads dropped DLL 1 IoCs
pid Process 1248 57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1248 wrote to memory of 2696 1248 57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe 28 PID 1248 wrote to memory of 2696 1248 57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe 28 PID 1248 wrote to memory of 2696 1248 57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe 28 PID 1248 wrote to memory of 2696 1248 57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"2⤵
- Deletes itself
- Executes dropped EXE
PID:2696
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD514ef027f5ba75f5a171d25beb096fecc
SHA12b71033f7baab19a283a8f653658c8bb91f068ad
SHA25613eacb47857c8e66128f67a8de76663ad2cdbc030a59243a5123e12144195e26
SHA512457ece1f63556c5c5f9100614d97c1860579d919cbf378243d8109bf6018b5e0fe84278a7c1b6294cb3f61ea3dc2310c8fe35f02ebafaee8b93fbdbba9eff139