97adc61b7912b8d547b384a57140d4b92ba8792b3cfa1c69130edcd00d7c1eb3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Size 482KB
Sample240519-2g2rnaed41
SHA256 97adc61b7912b8d547b384a57140d4b92ba8792b3cfa1c69130edcd00d7c1eb3
MD5 4d35b7be3643b06013953f3b4eea8d30
SHA1 8aad66bfdd21009d312e982a1ba0ddcb593d068d
SHA512 bbed4d0c89a0cb8503df960cbf1f108b13c92a003ff794f7708599a5efc685c4734a89d5020ea5a3a3967db6832c911153e92b4317994f5531fa514848066f98
SSDEEP 12288:XFMJSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:XFMJSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe

Malware Dropper & Backdoor - Berbew 6 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000a00000002343c-6.dat	family_berbew
behavioral2/files/0x0007000000023449-15.dat	family_berbew
behavioral2/files/0x000700000002344b-22.dat	family_berbew
behavioral2/files/0x000700000002344d-31.dat	family_berbew
behavioral2/files/0x000700000002344f-38.dat	family_berbew
behavioral2/files/0x0007000000023451-46.dat	family_berbew

Executes dropped EXE 6 IoCs

pid	Process
2944	Njljefql.exe
1116	Ngpjnkpf.exe
4636	Nnmopdep.exe
3224	Nqklmpdd.exe
4236	Ncldnkae.exe
2628	Nkcmohbg.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Njljefql.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2628	WerFault.exe	88

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2944	3660	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe	83
PID 3660 wrote to memory of 2944	3660	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe	83
PID 3660 wrote to memory of 2944	3660	4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe	83
PID 2944 wrote to memory of 1116	2944	Njljefql.exe	84
PID 2944 wrote to memory of 1116	2944	Njljefql.exe	84
PID 2944 wrote to memory of 1116	2944	Njljefql.exe	84
PID 1116 wrote to memory of 4636	1116	Ngpjnkpf.exe	85
PID 1116 wrote to memory of 4636	1116	Ngpjnkpf.exe	85
PID 1116 wrote to memory of 4636	1116	Ngpjnkpf.exe	85
PID 4636 wrote to memory of 3224	4636	Nnmopdep.exe	86
PID 4636 wrote to memory of 3224	4636	Nnmopdep.exe	86
PID 4636 wrote to memory of 3224	4636	Nnmopdep.exe	86
PID 3224 wrote to memory of 4236	3224	Nqklmpdd.exe	87
PID 3224 wrote to memory of 4236	3224	Nqklmpdd.exe	87
PID 3224 wrote to memory of 4236	3224	Nqklmpdd.exe	87
PID 4236 wrote to memory of 2628	4236	Ncldnkae.exe	88
PID 4236 wrote to memory of 2628	4236	Ncldnkae.exe	88
PID 4236 wrote to memory of 2628	4236	Ncldnkae.exe	88

C:\Users\Admin\AppData\Local\Temp\4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d35b7be3643b06013953f3b4eea8d30_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\Njljefql.exe
  C:\Windows\system32\Njljefql.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\Ngpjnkpf.exe
    C:\Windows\system32\Ngpjnkpf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\Nnmopdep.exe
      C:\Windows\system32\Nnmopdep.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3224
      - C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        7⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 420
        8⤵
        Program crash
        
        PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2628 -ip 2628
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dlddhggk.dll

Path C:\Windows\SysWOW64\Dlddhggk.dll
Size 7KB
SHA256 e5844b5b4672006d0236735182d806bc419854aaa9813621313efb76de7517a9
MD5 264dfee5319075a61117feef8117f084
SHA1 0f9e3a2d16e1f42f4d10d0d9093f4affdddacde3
SHA512 b7c9633012b0dd57610b2958bacd9e0af2b8cbf445985ff449728c828c3a04b043ff8d64d33ce0ade8c70238ed31ded6bca683b45a93a280590359d39e0fecb8
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPOd3cX5aXW:wUaJf/aFbP0O92JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 482KB
SHA256 282674b6cf350516756ff38614b5ea174c3fd75a9019954135d30c1e04c54e3a
MD5 eff16cb1dccb883336549f72feec45b5
SHA1 f50ed90992371bc793f0f1bb052dcd9895861bc5
SHA512 b2977b76ac6027fc8e5e6fa46668111f837737724b4f0362081a0b22fb6b0f0e26ebe1deddb1b49601e8338ae27a95c44f648d6824ca8070308c9b78b8d58480
SSDEEP 12288:UBdiq1SZvJSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:BZvJSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 482KB
SHA256 f89e028174e6f87aa5044667d764d5686ac3b9611071fdf4e9d1e8e8c31f4def
MD5 425c28554929fe48ce7f48c091bad7c6
SHA1 5feca1a3ee08992cc5617a06eb2c0db4e28970a1
SHA512 1f58024d57ca1e87e9850a36f084b9375439398258051f03d1b641b71973332d975f66768a51f0a5ba7aedf1a765a6197ae004d741349cfc713d9b1a5ee51e73
SSDEEP 12288:FzkaAHp5WKJSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:yaimKJSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njljefql.exe

Path C:\Windows\SysWOW64\Njljefql.exe
Size 482KB
SHA256 d2fbd75ee589e8d40e9780c16768d95a11112c00e9cb3569822169e13117c66e
MD5 a180481a58d294b482df89dee775cb6b
SHA1 85516b1ec9050eee5a3f0e2abdefab56b174201c
SHA512 155da07f98531d5b9a5a08ff338152951801243dffc6064c0ce7b2f3f9b9f2c8b3d8faf068d3bc11eb5ac137f0889765228a81028b46856543bc07cd35d8e467
SSDEEP 12288:aJRzWJSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:6RzWJSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 482KB
SHA256 7f2261e4e6391779385231ccea229c3844c92cd1b5ebc4e313598ec1011b5a2f
MD5 591a282e565de31f8deeaaafed4c6eae
SHA1 e6c9b20808b7892e2026b7a80b5f5de891739208
SHA512 5e7254af2801a4786c1dc74e5cd088ca5980c40c87c2885f49953c1e9660b9b027917c1162f0bb776b31660df3e91cc530d97c87510638e8c599b362c81a32fc
SSDEEP 12288:w4JSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:3JSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 482KB
SHA256 97d465b27906162a6939659089a0aab1cca345a2218c54b0c3b65f35eff127f3
MD5 483bfcc6a16e0d169fc6143f27f03a32
SHA1 9132b3c32ee8b8fb60e869b13967e287ecd701ca
SHA512 5dd1986948fec16c6eed3d1982d4a431a2f13a483fb9ca4865bf39f75632f91c1cbc96e3a19944ab67161860cdd7c48cbedaf001089178274b2007b909cb6ada
SSDEEP 12288:xl5z5JSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:jJSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 482KB
SHA256 1e941669ccc6a7cf5153a1d2a064f6f5f17400dd3fd18d551abe81ec69d02a33
MD5 d2279d6a1d5eec06baf313c345d4e6bb
SHA1 d2d2e53177a06ddf1355f3ff4a83eeafb75ee27c
SHA512 9d75437439d8facdf003fe5c85abc5b759414c741b69e7a85099ce5b1b4a493797eda02c40b84c849f7a31579d8a2eaee0816d03d4453ebd8e3dd767d4182360
SSDEEP 12288:vyvnSGJSLrpV6yYP4rbpV6yYPg058KpV6yYP8OThj:vshJSLrW4XWleKW8OThj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-53-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1116-16-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2628-48-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2628-49-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2944-52-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2944-7-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3224-50-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3224-32-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3660-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3660-54-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4236-44-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4636-51-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4636-24-0x0000000000400000-0x0000000000439000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads