Overview

overview

10

Static

static

10

2ef4960050...cs.exe

windows7-x64

10

2ef4960050...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ef49600502f0c0ccdfd2c20e4f436c0_NeikiAnalytics.exe

  • Size

    768KB

  • Sample

    240525-2s4qdseb22

  • MD5

    2ef49600502f0c0ccdfd2c20e4f436c0

  • SHA1

    d19e286c8ae3b592c1b47a543de0aa33ccece97d

  • SHA256

    9060e506b389e7099a19760fde821f2a566fcc21527a19f8e9d66242cf3a39e2

  • SHA512

    35470b5ba541141dcd3eae0eebbe59e9f6f49b5adaf599800cdbf4cf680f1f8700590aeabda864ab671cde94e24a16e03a1ddf48ee1593e0f10940d8cd63ad92

  • SSDEEP

    12288:KHDWvxM6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+C8lM1:wUMtaSHFaZRBEYyqmaf2qwiHPKgRC4g2

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      2ef49600502f0c0ccdfd2c20e4f436c0_NeikiAnalytics.exe

    • Size

      768KB

    • MD5

      2ef49600502f0c0ccdfd2c20e4f436c0

    • SHA1

      d19e286c8ae3b592c1b47a543de0aa33ccece97d

    • SHA256

      9060e506b389e7099a19760fde821f2a566fcc21527a19f8e9d66242cf3a39e2

    • SHA512

      35470b5ba541141dcd3eae0eebbe59e9f6f49b5adaf599800cdbf4cf680f1f8700590aeabda864ab671cde94e24a16e03a1ddf48ee1593e0f10940d8cd63ad92

    • SSDEEP

      12288:KHDWvxM6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+C8lM1:wUMtaSHFaZRBEYyqmaf2qwiHPKgRC4g2

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks