5a47265e44d1836d6d712534229b23bd0affa78380499e28c66e2065e04fed13

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe
Size

955KB
MD5

9a42a849f75e5ff10f1f024df79ee300
SHA1

48db8a92737c25d0acc944f29905fcd83085f18a
SHA256

5a47265e44d1836d6d712534229b23bd0affa78380499e28c66e2065e04fed13
SHA512

400496241fc3f4b923112acbdeb03a56335faae6a57c23ba19ffea99a26ff069a6a70bfc1d0f334bd6836209491b50fe1ecbd8a1db80ed5b684eb63528041ec3
SSDEEP

24576:oTEyf0c1QrLo8/B+OKzT7bLZmX1+RnM3L2N9Y3G3wSK6JE4t6FGerrthf:oTEe1Q/o8/8OKzT7/ZmF+RnM3L2N9YWW

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral1/files/0x001000000001226b-1.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
848	18DE.tmp

Executes dropped EXE 1 IoCs

pid	Process
848	18DE.tmp

Loads dropped DLL 1 IoCs

pid	Process
2176	9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 848	2176	9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 848	2176	9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 848	2176	9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 848	2176	9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a42a849f75e5ff10f1f024df79ee300_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\18DE.tmp
  "C:\Users\Admin\AppData\Local\Temp\18DE.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\18DE.tmp

Filesize
955KB

MD5
cab7d7aeaa42f595784f600f9dd2105b

SHA1
76cc0c0d9125e3088b671741cf27e81872d48283

SHA256
ccfb403ba5bb285116204996d1d411aba92daf7eefe100f5c3c2fc80bd807e36

SHA512
448806de5e086db0d21a2a9bb1ceb06162e434c69fe2e95dffbf9fd23fd9fbb5ebe60b1e8dcaf23834c8a8c72bd7bad734efe344ae2653769f903ffa2bb1cd5d

Download Submit