c6eca09c973710c7e753e173aba5e42d716b069beef3ee2e9118eb1c98075f4e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
Size

668KB
MD5

f5d9e6feddb661cee1f6e58641a4afa0
SHA1

27e89dd7a366c08638819cd0e36c96e1b409a1bd
SHA256

c6eca09c973710c7e753e173aba5e42d716b069beef3ee2e9118eb1c98075f4e
SHA512

28b81814356aefce7a21d9c1ca2154826e39a4bdb0abb95fc7a4c9f03c7ac8f6fbf8f9a0c75f17daf7a42103726aeada18cdcd80b325beb45fb21c9fac348708
SSDEEP

12288:2JxynlXCiuesiOEAKZg3lJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:23ylXCio3lJDHUVQ5zg2mblLO3VQ5zxs

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid process

2944 f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid process

2944 f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
Loads dropped DLL 1 IoCs

Processes:

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid process

2436 f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid process

2436 f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid process

2944 f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid	process
2944	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid	process
2944	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid	process
2436	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid	process
2436	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

pid	process
2944	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

description	pid	process	target process
PID 2436 wrote to memory of 2944	2436	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
PID 2436 wrote to memory of 2944	2436	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
PID 2436 wrote to memory of 2944	2436	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
PID 2436 wrote to memory of 2944	2436	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe	f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f5d9e6feddb661cee1f6e58641a4afa0_NeikiAnalytics.exe

Filesize
668KB

MD5
60fe52c2f38481a6d797cf8a8b5f5bfb

SHA1
3c3985d623c7acdeff2294951ab804df9fca8625

SHA256
280f71e99ca11e5d00c10062434bdd66de315888de1db359b2cb229dd3a9b3f7

SHA512
a1c14c312b980396f5d8d10b19a9087065c7cb2b1e91f916fd03d70e22f40b1403cb58bd5a3a391f286e0aa9575683ee91850da4be1ca3d591372a903f8bf369

Download Submit
memory/2436-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2436-10-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2436-6-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/2944-11-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2944-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2944-17-0x00000000001C0000-0x0000000000201000-memory.dmp

Filesize
260KB

Download