Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 21:54
Behavioral task
behavioral1
Sample
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
-
Size
283KB
-
MD5
05b5fffd6a630d4bbac378f57bf57d30
-
SHA1
307e8aaee699fdc120656e3fd4422a67b40d8f4c
-
SHA256
c039cd1982ec51c11842d760c99ff285b3b9b61b7fe6f84befc6848e5dddc8d3
-
SHA512
b12a79812ef884191260a52caab6d2e0c7bf941d189d07485b1dfb1ddf6f4aec7ddaad7a64e93db47b20b55266d84aea282ba2ab9efb3b26cbecd71f8ad0fa5e
-
SSDEEP
6144:Z0UB3C8QjMFH0RtCLgKO2eg1IqVC/CWPssZkVRnr5:ZrC3jeH4tjKOhqVVWPssZGr5
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe family_berbew -
Deletes itself 1 IoCs
Processes:
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exepid process 2016 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exepid process 2016 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 860 2628 WerFault.exe 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe 4724 2016 WerFault.exe 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exepid process 2628 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exepid process 2016 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exedescription pid process target process PID 2628 wrote to memory of 2016 2628 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe PID 2628 wrote to memory of 2016 2628 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe PID 2628 wrote to memory of 2016 2628 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe 05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 3962⤵
- Program crash
PID:860 -
C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 3643⤵
- Program crash
PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2628 -ip 26281⤵PID:3816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2016 -ip 20161⤵PID:2308
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exeFilesize
283KB
MD5b8ad3a6194b030677fb5a12c082284cd
SHA1088ddd8e4e391240ad1d332ea3f5771cfff2bbca
SHA25682c178ca8f5b5043017d1389c1f7d7ed788ec03a000499975e1e73f5b9c4ba09
SHA5126233893d7821c436fe49077efe65cfc47bffecd2e9046766234e68874a4e96093799a1ae3540d8d6455613ac491c021b33279ab6ae2c73abaa3b2dfbc797558a
-
memory/2016-7-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2016-8-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2016-13-0x0000000001520000-0x0000000001561000-memory.dmpFilesize
260KB
-
memory/2628-0-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2628-6-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB