89640cd301e0dfb7431636bd53acc1c8592659cd90f1e96b2ff75d85375b4be6

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
Size

384KB
MD5

739337e86d5fc3ee3c47179715863680
SHA1

e6609f359784adc53ee9fcdc360489b70045aebe
SHA256

89640cd301e0dfb7431636bd53acc1c8592659cd90f1e96b2ff75d85375b4be6
SHA512

3e69346b9878daa96853b983702a434365101e4a6302b35e96497d1245242cba950903b6aeee387eb6f876b19bfd0414a546cbab6faf63a5ffa9c07e2b829b02
SSDEEP

6144:CXKv4gdFKjnyRlJfjkEjiPISUOgW9X+hOGzC/NM:xQXjyljkmZzcukG2/

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
\Windows\SysWOW64\SJXO.exe	family_berbew

Executes dropped EXE 1 IoCs

Processes:

SJXO.exe

pid process

2632 SJXO.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2116 cmd.exe
2116 cmd.exe

pid	process
2632	SJXO.exe

pid	process
2116	cmd.exe
2116	cmd.exe

Drops file in System32 directory 3 IoCs

Processes:

739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe

description	ioc	process
File created	C:\windows\SysWOW64\SJXO.exe.bat	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
File created	C:\windows\SysWOW64\SJXO.exe	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
File opened for modification	C:\windows\SysWOW64\SJXO.exe	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exeSJXO.exe

pid process

2004 739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
2632 SJXO.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exeSJXO.exe

pid process

2004 739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
2004 739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
2632 SJXO.exe
2632 SJXO.exe

pid	process
2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
2632	SJXO.exe

pid	process
2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
2632	SJXO.exe
2632	SJXO.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

739337e86d5fc3ee3c47179715863680_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 2004 wrote to memory of 2116	2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe	cmd.exe
PID 2004 wrote to memory of 2116	2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe	cmd.exe
PID 2004 wrote to memory of 2116	2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe	cmd.exe
PID 2004 wrote to memory of 2116	2004	739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe	cmd.exe
PID 2116 wrote to memory of 2632	2116	cmd.exe	SJXO.exe
PID 2116 wrote to memory of 2632	2116	cmd.exe	SJXO.exe
PID 2116 wrote to memory of 2632	2116	cmd.exe	SJXO.exe
PID 2116 wrote to memory of 2632	2116	cmd.exe	SJXO.exe

C:\Users\Admin\AppData\Local\Temp\739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\739337e86d5fc3ee3c47179715863680_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\windows\system32\SJXO.exe.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116

C:\windows\SysWOW64\SJXO.exe
C:\windows\system32\SJXO.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2632

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SJXO.exe.bat
Filesize
72B

MD5
819ce0785c98053481ee433d50a2763a

SHA1
f4ccde0bc421d75990b93a4cae275f2539b30c7e

SHA256
53228ffde4f1bacfac4a712d75072a64ea72de9c22c831e8580b7fc6d37bb948

SHA512
588adf201948ac6d7d0a59a8129de81b00e0102fe33c78834b69a3a2150b934a95be6d0e01d875216dbffe60735ba93251d5d309f936a7c124cf258e9696322d

Download Submit
\Windows\SysWOW64\SJXO.exe
Filesize
384KB

MD5
66caf01ff9edaf99d973672b20b3e90b

SHA1
c9062634d2111bff910e71d7de72eec669436038

SHA256
ee615bfb1243e9621accb2b495b7aff52c0bfed7968c1995e0138c620b5de9f1

SHA512
0d5d1d90fcb8d8be6a83dca9f58b10b66bc3e84091acc6711dad9b3625c590f0e9098c2fea4c1ec0a9fa0ca297f0766e78ea18287b5fc08a256d0e28e3083fe2

Download Submit
memory/2004-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2004-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2116-15-0x0000000000170000-0x00000000001A9000-memory.dmp

Filesize
228KB

Download
memory/2116-18-0x0000000000170000-0x00000000001A9000-memory.dmp

Filesize
228KB

Download
memory/2632-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads