Overview

overview

10

Static

static

10

39371b56c9...cs.exe

windows7-x64

10

39371b56c9...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39371b56c91fdfeea7d8187ca9155e40_NeikiAnalytics.exe

  • Size

    128KB

  • Sample

    240525-3v89bsfg49

  • MD5

    39371b56c91fdfeea7d8187ca9155e40

  • SHA1

    f0c63f30e4e5eeec091f59079688ccbcd8252888

  • SHA256

    64fc8bb0dcda80100f44608074fd63b0f8842180a10c3768c4b9dbb22538957a

  • SHA512

    25425be9523a62e5c5f7252e11d35c2d2ae1165736c36d1897f099c7741d8d98c4d0c83a58158dd210e6d7805e21552c2c34211d0a1e42ca2227b60bdc02a0a0

  • SSDEEP

    3072:NGSTPTGwIRY1GG+2/BhHmiImXJ2fYdV46nfPyxWhj8NCM/r:0W0R7x4BhHmNEcYj9nhV8NCU

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      39371b56c91fdfeea7d8187ca9155e40_NeikiAnalytics.exe

    • Size

      128KB

    • MD5

      39371b56c91fdfeea7d8187ca9155e40

    • SHA1

      f0c63f30e4e5eeec091f59079688ccbcd8252888

    • SHA256

      64fc8bb0dcda80100f44608074fd63b0f8842180a10c3768c4b9dbb22538957a

    • SHA512

      25425be9523a62e5c5f7252e11d35c2d2ae1165736c36d1897f099c7741d8d98c4d0c83a58158dd210e6d7805e21552c2c34211d0a1e42ca2227b60bdc02a0a0

    • SSDEEP

      3072:NGSTPTGwIRY1GG+2/BhHmiImXJ2fYdV46nfPyxWhj8NCM/r:0W0R7x4BhHmNEcYj9nhV8NCU

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks