Overview

overview

10

Static

static

10

36767aaf90...cs.exe

windows7-x64

10

36767aaf90...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36767aaf90001483f52043e9a2d1c030_NeikiAnalytics.exe

  • Size

    357KB

  • Sample

    240523-j34h9sad8t

  • MD5

    36767aaf90001483f52043e9a2d1c030

  • SHA1

    1aa705e2e4f931d1afe3a9ce63457a8cd2f4d4e3

  • SHA256

    46501b0fe9a128d3a8637fff5efb7df2842e8d631888e1d3f8e056d6c2d69ab3

  • SHA512

    bc4e9ee093020f0fafca744781863a92dc551167bfa3503250df5b3062687ff1f416a2c444b21a7b4b65d80d66ae483c4b6999ae4066022b9d87d44ef921ec62

  • SSDEEP

    6144:rwObSme1n6xJmPMwZoXpKtCe8AUReheFlfSZR0SvsuFrGoyeg3kl+fiXFOFLaJP3:rwdZoXpKtCe1eehil6ZR5ZrQeg3kljFf

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      36767aaf90001483f52043e9a2d1c030_NeikiAnalytics.exe

    • Size

      357KB

    • MD5

      36767aaf90001483f52043e9a2d1c030

    • SHA1

      1aa705e2e4f931d1afe3a9ce63457a8cd2f4d4e3

    • SHA256

      46501b0fe9a128d3a8637fff5efb7df2842e8d631888e1d3f8e056d6c2d69ab3

    • SHA512

      bc4e9ee093020f0fafca744781863a92dc551167bfa3503250df5b3062687ff1f416a2c444b21a7b4b65d80d66ae483c4b6999ae4066022b9d87d44ef921ec62

    • SSDEEP

      6144:rwObSme1n6xJmPMwZoXpKtCe8AUReheFlfSZR0SvsuFrGoyeg3kl+fiXFOFLaJP3:rwdZoXpKtCe1eehil6ZR5ZrQeg3kljFf

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks