82ab3cb0cd44b3a7574d686daa9087d23609d91a12bfb066508ec88f14414a31

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe
Size 1021KB
Sample240511-d3rltaba3t
SHA256 82ab3cb0cd44b3a7574d686daa9087d23609d91a12bfb066508ec88f14414a31
MD5 6e55a4d4886fa94f3bfb52fc9df754a0
SHA1 c86464ef6d7799bf92a41ebcc1a8d58a089d86d9
SHA512 823e7ba179688824b4d7c7607ecaa2ed2e554ea1c67a6278711592bb3713fde5ef7053a76f388660a0c5d52e234b698f9e977e790843d6935e667f17bb3b4d49
SSDEEP 12288:grcUSIq3w9+7j0npM4dl0v5Jdm5IgVQBHzS+iYf8MWcqxgJj5v37QgzdrIVOmkVe:u+7jEM4dmv5BTqV0EM4dmv5BE2m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000a000000023407-5.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
2988	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5080	3880	WerFault.exe	81
5076	2988	WerFault.exe	86
4884	2988	WerFault.exe	86
4228	2988	WerFault.exe	86
5108	2988	WerFault.exe	86
5068	2988	WerFault.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3880	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2988	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 2988	3880	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe	86
PID 3880 wrote to memory of 2988	3880	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe	86
PID 3880 wrote to memory of 2988	3880	6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 384
  2⤵
  - Program crash
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 352
    3⤵
    - Program crash
    PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 768
    3⤵
    - Program crash
    PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 772
    3⤵
    - Program crash
    PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 776
    3⤵
    - Program crash
    PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 792
    3⤵
    - Program crash
    PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3880 -ip 3880
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2988 -ip 2988
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2988 -ip 2988
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2988 -ip 2988
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2988 -ip 2988
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2988 -ip 2988
1⤵
PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\6e55a4d4886fa94f3bfb52fc9df754a0_NeikiAnalytics.exe
Size 1021KB
SHA256 8320f4431d158565c31d83e44ac91fa687ed7a88cdd1c16ec3a9b2ce29ccc0a9
MD5 57f79212f2788c13521e859640d7aabf
SHA1 341568720c2cb8d89705a1d6d2a5f20333dc9d0e
SHA512 53eb44b5ec8eacd1df1f07e81697a5793bdda5cfae9f3eb1f8783538e82366bc1b423289c5b07308b25ce6788bd3be97330ff7d3879591219843efee10959178
SSDEEP 24576:h6On+ayk7jEM4dmv5BTqV0EM4dmv5BE2m:h6OnJyk7jj425Iyj425i2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2988-7-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2988-8-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2988-13-0x00000000014C0000-0x0000000001501000-memory.dmp

Download

memory/3880-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3880-6-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads