2551209bdfd91ae0196e91e74a8179b27c3351ea6ec4d1219499097e64afb415

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe
Size

724KB
MD5

406266ed2e1e1799e1baed1182012700
SHA1

ef05623a75da9a39c1aa86bbba0f2608dbde6f4e
SHA256

2551209bdfd91ae0196e91e74a8179b27c3351ea6ec4d1219499097e64afb415
SHA512

04c769659e88375fedc1928522a6c5441e74d8ce0d6114118a561f0244e8ae8872738d75db0376ec686e9d48c444819c807d40aa79c22b18b1aa5710cb5353a0
SSDEEP

12288:HWBm+95nHfF2mgewFx5u2HLmL7a0wUbb5CN1kfgjdkAnUKkD57lc0fzEV/d9RIYY:HWBz95ndbgfx5u5TBbFTgjTnUKkD57lr

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\44E8.tmp	family_berbew

Deletes itself 1 IoCs

Processes:

44E8.tmp

pid process

1380 44E8.tmp
Executes dropped EXE 1 IoCs

Processes:

44E8.tmp

pid process

1380 44E8.tmp

pid	process
1380	44E8.tmp

pid	process
1380	44E8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe

description	pid	process	target process
PID 4468 wrote to memory of 1380	4468	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	44E8.tmp
PID 4468 wrote to memory of 1380	4468	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	44E8.tmp
PID 4468 wrote to memory of 1380	4468	406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe	44E8.tmp

C:\Users\Admin\AppData\Local\Temp\406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4468

C:\Users\Admin\AppData\Local\Temp\44E8.tmp
"C:\Users\Admin\AppData\Local\Temp\44E8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\406266ed2e1e1799e1baed1182012700_NeikiAnalytics.exe 89ADB5849F51A502AC215EB5E0F98C0342C939FC086C8B77E8FB90EF574AABFC9A24697E2401B988F77CC71D9E4D30C6515BA7F727BDFCD5F3370DE67C8D16ED
2⤵
- Deletes itself
- Executes dropped EXE
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44E8.tmp
Filesize
724KB

MD5
cb619113bd9bc22f4609020231dfe5be

SHA1
e4d52c7fbaac84c9f9c2188cc324332acb877191

SHA256
7274a8605f52c67281f1c0f9e62d1e4e7084e56a4c130ed9249a27d7f1a16685

SHA512
ff27095b1d6300d3968b819d35e103c9f1ec6bdfeab27236a06c1b06a4a76ed47b075da7b553cfddb54b7b392be33329b5e8e0047acfc96b1325a53ee0c5e388

Download Submit
memory/1380-6-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1380-7-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4468-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4468-5-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download