69786e4efdb39829a96508e9e6f2c54ec2b83c788323a0db13c8c50b65775809

General

Target
2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe
Size 1.3MB
Sample240512-tkc9gage93
SHA256 69786e4efdb39829a96508e9e6f2c54ec2b83c788323a0db13c8c50b65775809
MD5 2b1df0c73707d9de437488d6fb2e63a0
SHA1 83ab466f34a1f4bb354c32726f08dd18040b837f
SHA512 ae488500bdc72fa7c9b529eb6093c1729e1ad9a35a08d48b476596bc553bfeaa4b711d1851f215db12bf778b4cb066b6b05b7b840a5f4305bd15a09a6e41af69
SSDEEP 24576:0zxA5XCTAc4ia3oxVhoZkV/Dxxa/ZSjXuF77Lv+f6T8Qnskb2i6OBKaBWvM:074ibVskgGXuFbq4TT+E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000c0000000233f1-5.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
4560	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4560	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	pastebin.com
12	pastebin.com

Program crash 15 IoCs

pid	pid_target	Process	procid_target
1012	2344	WerFault.exe	81
4828	4560	WerFault.exe	89
3640	4560	WerFault.exe	89
1212	4560	WerFault.exe	89
4780	4560	WerFault.exe	89
748	4560	WerFault.exe	89
4428	4560	WerFault.exe	89
5004	4560	WerFault.exe	89
4064	4560	WerFault.exe	89
3932	4560	WerFault.exe	89
2668	4560	WerFault.exe	89
3036	4560	WerFault.exe	89
1072	4560	WerFault.exe	89
4408	4560	WerFault.exe	89
3896	4560	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe
4560	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2344	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4560	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4560	2344	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe	89
PID 2344 wrote to memory of 4560	2344	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe	89
PID 2344 wrote to memory of 4560	2344	2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 352
  2⤵
  - Program crash
  PID:1012
- C:\Users\Admin\AppData\Local\Temp\2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 344
    3⤵
    - Program crash
    PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 628
    3⤵
    - Program crash
    PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 656
    3⤵
    - Program crash
    PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 680
    3⤵
    - Program crash
    PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 752
    3⤵
    - Program crash
    PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1008
    3⤵
    - Program crash
    PID:4428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1408
    3⤵
    - Program crash
    PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1500
    3⤵
    - Program crash
    PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1452
    3⤵
    - Program crash
    PID:3932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1476
    3⤵
    - Program crash
    PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1708
    3⤵
    - Program crash
    PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1500
    3⤵
    - Program crash
    PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1716
    3⤵
    - Program crash
    PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 592
    3⤵
    - Program crash
    PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2344 -ip 2344
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4560 -ip 4560
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4560 -ip 4560
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4560 -ip 4560
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 4560
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4560 -ip 4560
1⤵
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4560 -ip 4560
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4560 -ip 4560
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4560 -ip 4560
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4560 -ip 4560
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 4560
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4560 -ip 4560
1⤵
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4560 -ip 4560
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\2b1df0c73707d9de437488d6fb2e63a0_NeikiAnalytics.exe
Size 1.3MB
SHA256 6e848b50043a3963728890eb90e4ffe2f0db6ec25bce5349c4a248215efd7a92
MD5 53a1f7d58609be30e4e2610a3ed81d6b
SHA1 378bddffc6ecdda422daf018a3863bd63aa4f981
SHA512 5787ed3d35fc6928f41689c5ec055f0bbb03f4bc54177bf81a9a591b08c92d66ee5c3ab9c574eeaa084a3b555ebd96e978f4297d22c40e61b230cede3ae3ea35
SSDEEP 24576:b84Zj9hKkV/ncaek9OIjMSXfb8uTPXzwr44a/ZSjXuF77Lv+f6T8Qnskb2i6OBKS:bB9hK+/ca3gIgSvbTPXzwNgGXuFbq4T9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2344-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2344-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4560-6-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4560-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4560-14-0x00000000050D0000-0x00000000051BF000-memory.dmp

Download

memory/4560-24-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4560-29-0x000000000B990000-0x000000000BA33000-memory.dmp

Download

memory/4560-30-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads