4227c22fa28a402b80a42564fbae5ca9651535de48605f6f72b15aac24b9876b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
Size 256KB
Sample240511-d71qaaea67
SHA256 4227c22fa28a402b80a42564fbae5ca9651535de48605f6f72b15aac24b9876b
MD5 70b4537289dee6719456d669e1fa9cc0
SHA1 dc44e23ca28c55870baeec84fa76c414d1957b6a
SHA512 163f5fefd181a2f9b6b6b5be18c61aff0d49ac176fec19fc86211f11687cbe50a7ab75f8d507f076600e205cd50c8cdc9c23bb4802e92fe071c0c5bebf6be994
SSDEEP 6144:ectVXYLAPbY+xmrTlk2KpkEjiPISUOgW9X+h8:RqLAPvx4TODpkmZzcui
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral1/files/0x000b0000000144e0-14.dat	family_berbew

Executes dropped EXE 1 IoCs

pid	Process
2592	UFOIIJ.exe

Loads dropped DLL 2 IoCs

pid	Process
2540	cmd.exe
2540	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\UFOIIJ.exe	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
File opened for modification	C:\windows\SysWOW64\UFOIIJ.exe	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
File created	C:\windows\SysWOW64\UFOIIJ.exe.bat	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
2592	UFOIIJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
2592	UFOIIJ.exe
2592	UFOIIJ.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2540	2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 2540	2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 2540	2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 2540	2204	70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe	28
PID 2540 wrote to memory of 2592	2540	cmd.exe	30
PID 2540 wrote to memory of 2592	2540	cmd.exe	30
PID 2540 wrote to memory of 2592	2540	cmd.exe	30
PID 2540 wrote to memory of 2592	2540	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\70b4537289dee6719456d669e1fa9cc0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\windows\system32\UFOIIJ.exe.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\windows\SysWOW64\UFOIIJ.exe
    C:\windows\system32\UFOIIJ.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UFOIIJ.exe.bat

Path C:\Windows\SysWOW64\UFOIIJ.exe.bat
Size 76B
SHA256 bc93945260aa162f57cb3fafd8d79c3de7357bf148ae6deba87159e48e386c2c
MD5 ad2459b038cfa3f2b0f75877d35ea204
SHA1 e8b5cea16103ab49a047cda10655f16f14eb6fc0
SHA512 98a171f5fef7aacc33e7637a580eb34cb34b226c61349a4eec38ac58c6ce77c12d7bb47bf3350d166a653619bc7dafcdd40cfa94f5e194396503915b4d443d7b
MD5 SHA1 SHA512

Submit Download

UFOIIJ.exe

Path \Windows\SysWOW64\UFOIIJ.exe
Size 256KB
SHA256 4e40b8622f6985c7aa26138c7dce1cf11945dee4b45f220ccfa1700fa1d5e22d
MD5 1ea49ed554170fbf212bc1fdacc1c3b8
SHA1 cd829a773b706c11561e6c4c5982c9bd02235d68
SHA512 8dcdf415001ad8666cc1e07b529c0c0b8d779376afe24b8678b71989de6806f3f016bdc46a4af382e80b6909cf2597f90e7007068635e6c8983e72e0cb81c261
SSDEEP 6144:m7C3GHVmwis6t3PYeC4/fNVkEjiPISUOgW9X+h8:6sYeC4/fNVkmZzcui
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2204-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2204-12-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2540-15-0x0000000000370000-0x00000000003A9000-memory.dmp

Download

memory/2592-19-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2592-20-0x0000000000400000-0x0000000000439000-memory.dmp

Download