Overview

overview

10

Static

static

10

440c5cce12...cs.exe

windows7-x64

10

440c5cce12...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    440c5cce1206e1af2de66837bd864820_NeikiAnalytics

  • Size

    113KB

  • Sample

    240515-159xhafa58

  • MD5

    440c5cce1206e1af2de66837bd864820

  • SHA1

    781c115df626471e1f54241f3b4a60d71addc40d

  • SHA256

    0d143f51d32cea142ce56dcab062ee8e0003fd4c49305d6b492c0edec2f73a00

  • SHA512

    b6df37a7cf93f011e4296d718e7d48bc880468613b160205d434091bd4da67b99012f97f8dfa9f3c863c375527de3b15bbd79b5d49ac6fb7d6a767ef4d2a8951

  • SSDEEP

    3072:qY+O03Wvz/n0fOuGkZFfFSebHWrH8wTW0:j+O0Gvz/n0m7otSeWrP

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      440c5cce1206e1af2de66837bd864820_NeikiAnalytics

    • Size

      113KB

    • MD5

      440c5cce1206e1af2de66837bd864820

    • SHA1

      781c115df626471e1f54241f3b4a60d71addc40d

    • SHA256

      0d143f51d32cea142ce56dcab062ee8e0003fd4c49305d6b492c0edec2f73a00

    • SHA512

      b6df37a7cf93f011e4296d718e7d48bc880468613b160205d434091bd4da67b99012f97f8dfa9f3c863c375527de3b15bbd79b5d49ac6fb7d6a767ef4d2a8951

    • SSDEEP

      3072:qY+O03Wvz/n0fOuGkZFfFSebHWrH8wTW0:j+O0Gvz/n0m7otSeWrP

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks