Overview

overview

10

Static

static

10

5d6e9eceba...cs.exe

windows7-x64

10

5d6e9eceba...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d6e9ecebaa07acfd4221c417a3534c0_NeikiAnalytics.exe

  • Size

    94KB

  • Sample

    240522-31exnsdh8t

  • MD5

    5d6e9ecebaa07acfd4221c417a3534c0

  • SHA1

    2c04cb2561b07f4608af3cddc9670e98b41bce81

  • SHA256

    652245e435118aa1cf279ec10811a7d8de742ad17df62d116af11708569f2c15

  • SHA512

    4b783274f35c266c5ffc096a8f9724c74f38d512167743631d9f1d05c7923db107e7f0dfeeb37bf301ef7c278294e91ff86293472b164e13e888378ea16ef281

  • SSDEEP

    1536:x2zUczsk5K8/BDtBRSWfLPHq39KUIC0uGmVJHQj1BEsCOyiKbZ9rQJg:x6U0skg8/xkWfjH6KU90uGimj1ieybvN

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      5d6e9ecebaa07acfd4221c417a3534c0_NeikiAnalytics.exe

    • Size

      94KB

    • MD5

      5d6e9ecebaa07acfd4221c417a3534c0

    • SHA1

      2c04cb2561b07f4608af3cddc9670e98b41bce81

    • SHA256

      652245e435118aa1cf279ec10811a7d8de742ad17df62d116af11708569f2c15

    • SHA512

      4b783274f35c266c5ffc096a8f9724c74f38d512167743631d9f1d05c7923db107e7f0dfeeb37bf301ef7c278294e91ff86293472b164e13e888378ea16ef281

    • SSDEEP

      1536:x2zUczsk5K8/BDtBRSWfLPHq39KUIC0uGmVJHQj1BEsCOyiKbZ9rQJg:x6U0skg8/xkWfjH6KU90uGimj1ieybvN

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks