Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-05-2024 13:39

General

  • Target

    57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe

  • Size

    1004KB

  • MD5

    39fbf397ea1f659abce5bd6c03ea1b10

  • SHA1

    e886dc1631da51cc9e86a76df159c9b85e6ac7a4

  • SHA256

    57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b

  • SHA512

    65d892d897b39b6b4a43666bc8ff4c4715e5ed435b2e551fb8afb34e424295b020371ed40a53d691e90827371858bb4650eeb64503f168a83b1daf83a93a4f02

  • SSDEEP

    24576:3MUge+fns8RTRmlw3VURLrxOmpMXoa/ZSCBHn677:3h7aRT3SR5IogVBHn6

Score
10/10

Malware Config

Signatures

  • Malware Dropper & Backdoor - Berbew 1 IoCs

    Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\57baf486e174f9cffc8b57e475c06790817972eed1394e7217f6d8193ae8ce0b_NeikiAnalytics.exe

    Filesize

    1004KB

    MD5

    1640a57db64679ccabff7a0e72f62726

    SHA1

    647af8cdd5853adbe1b9fb4cf7aa54f8ad2e2879

    SHA256

    a1ee693be95e5d1ad4fccc602199ad8d5ad6ba2cee49f54d22b52ceb426cae39

    SHA512

    be596b5ffd3eadb6159244d0160fe275284fcc9b1cf81552ed8a0d4049694db35099dcdf3ca59fefe9dcc6e64af5777fcbb7fc69299c2431c4b9354ab49152a6

  • memory/2272-0-0x0000000000400000-0x00000000004EF000-memory.dmp

    Filesize

    956KB

  • memory/2272-7-0x0000000002F80000-0x000000000306F000-memory.dmp

    Filesize

    956KB

  • memory/2272-10-0x0000000000400000-0x00000000004EF000-memory.dmp

    Filesize

    956KB

  • memory/2500-9-0x0000000000400000-0x00000000004EF000-memory.dmp

    Filesize

    956KB

  • memory/2500-17-0x0000000002EA0000-0x0000000002F8F000-memory.dmp

    Filesize

    956KB

  • memory/2500-12-0x0000000000400000-0x00000000004A3000-memory.dmp

    Filesize

    652KB

  • memory/2500-33-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2500-39-0x000000000EF70000-0x000000000F013000-memory.dmp

    Filesize

    652KB