975cafebb09b3ae6c7c7269e77ed5e4011fe659ca8d7c7a88a86d58c32c35f9f

Analysis

max time kernel
129s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe
Size

240KB
MD5

e07ef1eb46dfedc2d279dfad3fc46750
SHA1

5cfcbda0f976bd4dac507ba76cb61fc00571aa24
SHA256

975cafebb09b3ae6c7c7269e77ed5e4011fe659ca8d7c7a88a86d58c32c35f9f
SHA512

5eee3a80e9514957cb274858b015f18428625c96e54b0d3a3341663b1b9e9579d172ccdbfcd4f7c2c05050db6640ea4ae35c29a6f6806018229e8bf21f646e34
SSDEEP

6144:zfQ4BntZV63+WSIGPGkfbJycOMADMqlJix31CEvY5BQwKSql46:TQOnDV6uWQ9oMAD3lJbEvoKlSqld

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000c0000000233f6-5.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
3564	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3564	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4168	4136	WerFault.exe	82
2796	3564	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4136	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3564	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3564	4136	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe	88
PID 4136 wrote to memory of 3564	4136	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe	88
PID 4136 wrote to memory of 3564	4136	e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 396
  2⤵
  - Program crash
  PID:4168
- C:\Users\Admin\AppData\Local\Temp\e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 364
    3⤵
    - Program crash
    PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4136 -ip 4136
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3564 -ip 3564
1⤵
PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e07ef1eb46dfedc2d279dfad3fc46750_NeikiAnalytics.exe

Filesize
240KB

MD5
5ca78f50fb32221971cf72ac472c9863

SHA1
7229fcceb238ccdf4c102ac1f62ee80047b5e61b

SHA256
26723d81ceba3c040dc3e4877f2473ef98053238ff5280b585e5c1202509a47f

SHA512
07f5522307624f4d863f0736557d5fccefcf9c5368558ec84878aa93eb560c92e5bcfd3d26a051a12a1874b9b3a1545e3efe25ff001e6a691c3b29ebeef64da6

Download Submit
memory/3564-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3564-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3564-13-0x00000000014C0000-0x0000000001500000-memory.dmp

Filesize
256KB

Download
memory/3564-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4136-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4136-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download