c039cd1982ec51c11842d760c99ff285b3b9b61b7fe6f84befc6848e5dddc8d3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
Size

283KB
MD5

05b5fffd6a630d4bbac378f57bf57d30
SHA1

307e8aaee699fdc120656e3fd4422a67b40d8f4c
SHA256

c039cd1982ec51c11842d760c99ff285b3b9b61b7fe6f84befc6848e5dddc8d3
SHA512

b12a79812ef884191260a52caab6d2e0c7bf941d189d07485b1dfb1ddf6f4aec7ddaad7a64e93db47b20b55266d84aea282ba2ab9efb3b26cbecd71f8ad0fa5e
SSDEEP

6144:Z0UB3C8QjMFH0RtCLgKO2eg1IqVC/CWPssZkVRnr5:ZrC3jeH4tjKOhqVVWPssZGr5

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000b0000000233fb-4.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
2016	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2016	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
860	2628	WerFault.exe	83
4724	2016	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2628	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2016	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2016	2628	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe	89
PID 2628 wrote to memory of 2016	2628	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe	89
PID 2628 wrote to memory of 2016	2628	05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 396
  2⤵
  - Program crash
  PID:860
- C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 364
    3⤵
    - Program crash
    PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2628 -ip 2628
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2016 -ip 2016
1⤵
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\05b5fffd6a630d4bbac378f57bf57d30_NeikiAnalytics.exe

Filesize
283KB

MD5
b8ad3a6194b030677fb5a12c082284cd

SHA1
088ddd8e4e391240ad1d332ea3f5771cfff2bbca

SHA256
82c178ca8f5b5043017d1389c1f7d7ed788ec03a000499975e1e73f5b9c4ba09

SHA512
6233893d7821c436fe49077efe65cfc47bffecd2e9046766234e68874a4e96093799a1ae3540d8d6455613ac491c021b33279ab6ae2c73abaa3b2dfbc797558a

Download Submit
memory/2016-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2016-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2016-13-0x0000000001520000-0x0000000001561000-memory.dmp

Filesize
260KB

Download
memory/2628-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2628-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download