2551209bdfd91ae0196e91e74a8179b27c3351ea6ec4d1219499097e64afb415

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe
Size

724KB
MD5

406266ed2e1e1799e1baed1182012700
SHA1

ef05623a75da9a39c1aa86bbba0f2608dbde6f4e
SHA256

2551209bdfd91ae0196e91e74a8179b27c3351ea6ec4d1219499097e64afb415
SHA512

04c769659e88375fedc1928522a6c5441e74d8ce0d6114118a561f0244e8ae8872738d75db0376ec686e9d48c444819c807d40aa79c22b18b1aa5710cb5353a0
SSDEEP

12288:HWBm+95nHfF2mgewFx5u2HLmL7a0wUbb5CN1kfgjdkAnUKkD57lc0fzEV/d9RIYY:HWBz95ndbgfx5u5TBbFTgjTnUKkD57lr

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\13CF.tmp	family_berbew

Deletes itself 1 IoCs

Processes:

13CF.tmp

pid process

3036 13CF.tmp
Executes dropped EXE 1 IoCs

Processes:

13CF.tmp

pid process

3036 13CF.tmp
Loads dropped DLL 1 IoCs

Processes:

406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe

pid process

1648 406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe

pid	process
3036	13CF.tmp

pid	process
3036	13CF.tmp

pid	process
1648	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe

description	pid	process	target process
PID 1648 wrote to memory of 3036	1648	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	13CF.tmp
PID 1648 wrote to memory of 3036	1648	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	13CF.tmp
PID 1648 wrote to memory of 3036	1648	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	13CF.tmp
PID 1648 wrote to memory of 3036	1648	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	13CF.tmp

C:\Users\Admin\AppData\Local\Temp\406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\13CF.tmp
"C:\Users\Admin\AppData\Local\Temp\13CF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe 92FAD097E01E37C0825B0116C286E8D57075F4470868173FB4E0CBCAA291CEE663410AD31A9D4D333662128CAC4C97731D2256546413C865128740A559AAB7BA
2⤵
- Deletes itself
- Executes dropped EXE
PID:3036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\13CF.tmp
Filesize
724KB

MD5
39506bbcc739b80716b3c315879d7229

SHA1
8806a152489c43a4d79d1ba3b4289b6a910861ac

SHA256
eeb6689093c830cf12251f88a6a2d028d785f6777b4c0804bfcef26d1442a2fe

SHA512
bae2fac049aa329fe2e8eb4ab606688efd2824a094e2d90a3433fbb2f9d789a14b7e13bd2f0b68f786ee51e616e03305ea47c6ce3051ae731a36d38de18e09f2

Download Submit
memory/1648-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1648-4-0x0000000000360000-0x00000000003E9000-memory.dmp

Filesize
548KB

Download
memory/1648-7-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3036-8-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3036-9-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download