Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 13:39
Behavioral task
behavioral1
Sample
57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe
-
Size
1004KB
-
MD5
39fbf397ea1f659abce5bd6c03ea1b10
-
SHA1
e886dc1631da51cc9e86a76df159c9b85e6ac7a4
-
SHA256
57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b
-
SHA512
65d892d897b39b6b4a43666bc8ff4c4715e5ed435b2e551fb8afb34e424295b020371ed40a53d691e90827371858bb4650eeb64503f168a83b1daf83a93a4f02
-
SSDEEP
24576:3MUge+fns8RTRmlw3VURLrxOmpMXoa/ZSCBHn677:3h7aRT3SR5IogVBHn6
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000d00000001232c-4.dat family_berbew -
Deletes itself 1 IoCs
pid Process 2500 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 2500 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe -
Loads dropped DLL 1 IoCs
pid Process 2272 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 pastebin.com 4 pastebin.com -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2500 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2272 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2500 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2500 2272 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe 29 PID 2272 wrote to memory of 2500 2272 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe 29 PID 2272 wrote to memory of 2500 2272 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe 29 PID 2272 wrote to memory of 2500 2272 57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe
Filesize1004KB
MD51640a57db64679ccabff7a0e72f62726
SHA1647af8cdd5853adbe1b9fb4cf7aa54f8ad2e2879
SHA256a1ee693be95e5d1ad4fccc602199ad8d5ad6ba2cee49f54d22b52ceb426cae39
SHA512be596b5ffd3eadb6159244d0160fe275284fcc9b1cf81552ed8a0d4049694db35099dcdf3ca59fefe9dcc6e64af5777fcbb7fc69299c2431c4b9354ab49152a6