Overview

overview

10

Static

static

10

234762a412...cs.exe

windows7-x64

10

234762a412...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    234762a412edb97c53a136940e6de480_NeikiAnalytics.exe

  • Size

    109KB

  • Sample

    240525-1jtcmabh83

  • MD5

    234762a412edb97c53a136940e6de480

  • SHA1

    a6f71c0b80b7a9417144b1f26e5f81300ba149f1

  • SHA256

    42fad2257b45c3ff9cdfb95df831ebb8f4bcd303683e3d0d8de472c2018eede5

  • SHA512

    f7ab71d77644ee20d8283f7c0d1959be1ae908e3bb8b3fcfaa24a4354e17e5f5dcac5cfb04804edb2210e4e1def5899a1ad5c2845b1d5fc52e70104b7c464bb8

  • SSDEEP

    3072:+j4ugXAgbrkMW0J9CLCqwzBu1DjHLMVDqqkSp:+j5EfFW0J92wtu1DjrFqh

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      234762a412edb97c53a136940e6de480_NeikiAnalytics.exe

    • Size

      109KB

    • MD5

      234762a412edb97c53a136940e6de480

    • SHA1

      a6f71c0b80b7a9417144b1f26e5f81300ba149f1

    • SHA256

      42fad2257b45c3ff9cdfb95df831ebb8f4bcd303683e3d0d8de472c2018eede5

    • SHA512

      f7ab71d77644ee20d8283f7c0d1959be1ae908e3bb8b3fcfaa24a4354e17e5f5dcac5cfb04804edb2210e4e1def5899a1ad5c2845b1d5fc52e70104b7c464bb8

    • SSDEEP

      3072:+j4ugXAgbrkMW0J9CLCqwzBu1DjHLMVDqqkSp:+j5EfFW0J92wtu1DjrFqh

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks