Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 14:13

General

  • Target

    57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe

  • Size

    960KB

  • MD5

    57253ea6c3d290a72ed2b861efb1e320

  • SHA1

    f1a2739c4683356c700aa75e446612f85ad3cc0d

  • SHA256

    ea7dc678eb5e1b60662eac77e0ff06d4d6acf9bc2e00d333731f1d12ea71edd2

  • SHA512

    d5a589b401f55922104691ea595ea7682f727d9c4426aa021e903ad7989b6a1b4573348e524c696f14fd8a0242fde415307df27e83aa99137c2db69eecaebeb4

  • SSDEEP

    24576:6aOjAhNbvoulyxKxGLZmN1VUZm8k3uql6lrdU7Qwi:6aOshBvfG3ZmXiZm8k3uql6lrdU7Qwi

Score
10/10

Malware Config

Signatures

  • Malware Dropper & Backdoor - Berbew 1 IoCs

    Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\57253ea6c3d290a72ed2b861efb1e320_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\EA1.tmp
      "C:\Users\Admin\AppData\Local\Temp\EA1.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2696

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\EA1.tmp

          Filesize

          960KB

          MD5

          14ef027f5ba75f5a171d25beb096fecc

          SHA1

          2b71033f7baab19a283a8f653658c8bb91f068ad

          SHA256

          13eacb47857c8e66128f67a8de76663ad2cdbc030a59243a5123e12144195e26

          SHA512

          457ece1f63556c5c5f9100614d97c1860579d919cbf378243d8109bf6018b5e0fe84278a7c1b6294cb3f61ea3dc2310c8fe35f02ebafaee8b93fbdbba9eff139