Overview

overview

10

Static

static

10

2d7f151c67...cs.exe

windows7-x64

10

2d7f151c67...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d7f151c673993cf9a726a47c3445990_NeikiAnalytics.exe

  • Size

    109KB

  • Sample

    240525-2ntdvsdb7y

  • MD5

    2d7f151c673993cf9a726a47c3445990

  • SHA1

    9c43d3609a4162e5701289bc224735bef1fc8fcc

  • SHA256

    b4eee0f94f11fd7cad080068f5c4c45007c973de84d4fe78665ccb6e88609d8a

  • SHA512

    2eb7130df29acf622963a2fb627ef5ae1a62ac7d524409840093004e8b6fdc1c99ce22368111b9523cd9559e03f01eafc69c8ffa260c37c8dfdf358398f158f4

  • SSDEEP

    3072:nFYAVLE+TXRBu0n9TJ9upLCqwzBu1DjHLMVDqqkSpR:eAXX60n1J9Cwtu1DjrFqhz

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      2d7f151c673993cf9a726a47c3445990_NeikiAnalytics.exe

    • Size

      109KB

    • MD5

      2d7f151c673993cf9a726a47c3445990

    • SHA1

      9c43d3609a4162e5701289bc224735bef1fc8fcc

    • SHA256

      b4eee0f94f11fd7cad080068f5c4c45007c973de84d4fe78665ccb6e88609d8a

    • SHA512

      2eb7130df29acf622963a2fb627ef5ae1a62ac7d524409840093004e8b6fdc1c99ce22368111b9523cd9559e03f01eafc69c8ffa260c37c8dfdf358398f158f4

    • SSDEEP

      3072:nFYAVLE+TXRBu0n9TJ9upLCqwzBu1DjHLMVDqqkSpR:eAXX60n1J9Cwtu1DjrFqhz

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks