90e9e14e7a4e7d34c0244edc35a882f3d94c6a0e64daf49b9b8ba035b154e9e5

Analysis

max time kernel
129s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
Size

283KB
MD5

40099a386e90b8bbe77ce5b2f0ad9730
SHA1

819c88d9fe47fbd60edbed851a971c6c6218e0b6
SHA256

90e9e14e7a4e7d34c0244edc35a882f3d94c6a0e64daf49b9b8ba035b154e9e5
SHA512

63c5a162e4f8184a5bc502481965879379dc165b160586e72a6cc7d3e94168e2f58734f1a40eba23de4d9a4f7c4c9aff53aa93b0fc8e7ed814516c181159083c
SSDEEP

6144:/IUP634zdIk9CI+RU3okbW7HbIqVC/CWPssZkVRnr5:/IKn9CI+RIijEqVVWPssZGr5

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid process

1348 40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid process

1348 40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid	process
1348	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid	process
1348	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4796	3636	WerFault.exe	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
4312	1348	WerFault.exe	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid process

3636 40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid process

1348 40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid	process
3636	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

pid	process
1348	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

description	pid	process	target process
PID 3636 wrote to memory of 1348	3636	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
PID 3636 wrote to memory of 1348	3636	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
PID 3636 wrote to memory of 1348	3636	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe	40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 396
2⤵
- Program crash
PID:4796

C:\Users\Admin\AppData\Local\Temp\40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 372
3⤵
- Program crash
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3636 -ip 3636
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1348 -ip 1348
1⤵
PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40099a386e90b8bbe77ce5b2f0ad9730_NeikiAnalytics.exe
Filesize
283KB

MD5
8c59bc979eee8299f6bab6bbce243856

SHA1
728192e5ee5c4a310c2633cb8723e4d686c593ca

SHA256
d049009de557b768af4649b109ba7727952c4d42b794f6899e81caab56ce6e87

SHA512
ba9dfdfae27d616ba0ec2d8fe4e9276875fe46a8cf66f354de232f833b2790764219f30257b8c3e2d4bd1bea31cdb16fcacf712c512349a7b758609da9fe2422

Download Submit
memory/1348-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1348-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1348-13-0x00000000014A0000-0x00000000014E1000-memory.dmp

Filesize
260KB

Download
memory/3636-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3636-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download