Analysis

  • max time kernel
    131s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 03:52

General

  • Target

    181db888bf33cca99f4476e9a2f8ac90_NeikiAnalytics.exe

  • Size

    1004KB

  • MD5

    181db888bf33cca99f4476e9a2f8ac90

  • SHA1

    ec2dc6567b58c88136367bdaf33b24416cd8e6c6

  • SHA256

    d6f0f1b879263af9ec2a63733a0cff9994203a7cdc994e193749f4238d4c0a0e

  • SHA512

    4e0aacf01697cd667c656c3e1eee12f88c7a172ac3bdd7460303e4cbfab69f0c9218ae364514c8c48d442b5a009f314a8bd5e519cf396269e57891c7767dd106

  • SSDEEP

    24576:bozoTIZag459tan13wabhma/ZSCBHn677:koTd9tU13wQmgVBHn6

Score
10/10

Malware Config

Signatures

  • Malware Dropper & Backdoor - Berbew 1 IoCs

    Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Program crash 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\181db888bf33cca99f4476e9a2f8ac90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\181db888bf33cca99f4476e9a2f8ac90_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 352
      2⤵
      • Program crash
      PID:832
    • C:\Users\Admin\AppData\Local\Temp\181db888bf33cca99f4476e9a2f8ac90_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\181db888bf33cca99f4476e9a2f8ac90_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 344
        3⤵
        • Program crash
        PID:2812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 632
        3⤵
        • Program crash
        PID:2696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 668
        3⤵
        • Program crash
        PID:4980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 668
        3⤵
        • Program crash
        PID:1720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 680
        3⤵
        • Program crash
        PID:1624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 920
        3⤵
        • Program crash
        PID:3660
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1408
        3⤵
        • Program crash
        PID:2280
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1456
        3⤵
        • Program crash
        PID:4908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1468
        3⤵
        • Program crash
        PID:3068
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1472
        3⤵
        • Program crash
        PID:3116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1460
        3⤵
        • Program crash
        PID:2344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1512
        3⤵
        • Program crash
        PID:4596
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1540
        3⤵
        • Program crash
        PID:4960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 636
        3⤵
        • Program crash
        PID:4620
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 2112
    1⤵
      PID:3436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1508 -ip 1508
      1⤵
        PID:2328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1508 -ip 1508
        1⤵
          PID:4780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 1508
          1⤵
            PID:1276
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1508 -ip 1508
            1⤵
              PID:4464
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1508 -ip 1508
              1⤵
                PID:1676
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1508 -ip 1508
                1⤵
                  PID:3320
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1508 -ip 1508
                  1⤵
                    PID:728
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1508 -ip 1508
                    1⤵
                      PID:4352
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1508 -ip 1508
                      1⤵
                        PID:3352
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1508 -ip 1508
                        1⤵
                          PID:4220
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1508 -ip 1508
                          1⤵
                            PID:4360
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1508 -ip 1508
                            1⤵
                              PID:3360
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1508 -ip 1508
                              1⤵
                                PID:644
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1508 -ip 1508
                                1⤵
                                  PID:1068

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\181db888bf33cca99f4476e9a2f8ac90_NeikiAnalytics.exe

                                  Filesize

                                  1004KB

                                  MD5

                                  9a41aee67e5e31cb134b9c8148034089

                                  SHA1

                                  eefd219248236cda28b63c1c0a6606cb79454e26

                                  SHA256

                                  8746b56789ef51a9c2ccdfbcbb596cd454c4928f58274b71ad2dd18719be47a5

                                  SHA512

                                  80ba092e8ccc48601b4899d6cf07dfb41ee4a0da1b2f5dc59ec03193d2d819c948f799003ac7c86f131a1c115efe540de06334abc9b299c56261c523c22a13ef

                                • memory/1508-7-0x0000000000400000-0x00000000004EF000-memory.dmp

                                  Filesize

                                  956KB

                                • memory/1508-8-0x0000000000400000-0x00000000004A3000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/1508-14-0x0000000004FD0000-0x00000000050BF000-memory.dmp

                                  Filesize

                                  956KB

                                • memory/1508-21-0x0000000000400000-0x0000000000443000-memory.dmp

                                  Filesize

                                  268KB

                                • memory/1508-27-0x000000000B970000-0x000000000BA13000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/2112-0-0x0000000000400000-0x00000000004EF000-memory.dmp

                                  Filesize

                                  956KB

                                • memory/2112-5-0x0000000000400000-0x00000000004EF000-memory.dmp

                                  Filesize

                                  956KB