Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 02:53
General
-
Target
56bd230d5641761d3fcae0d8c536a640_NeikiAnalytics.exe
-
Size
1.9MB
-
MD5
56bd230d5641761d3fcae0d8c536a640
-
SHA1
f616a8760fc962fc0dfcbaa7d8bab8942aa15885
-
SHA256
23339a49e15ba1c212b8940475c63081fea79bd405617362049bb2cd107bc44f
-
SHA512
8d7a7e1681bf4708bdfe0061120eaf775abde587234c2841a17ca052d730482a09b1ed66599fa1074cf4af4b5007cdfbefd3b46e4c87ae5220567d171db3e553
-
SSDEEP
49152:PiGbpfNPyupenXN5NgPyeBhbq4TTow+lsgr5e:v4XNayeBhhTW75
Score
10/10
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 5 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Program crash 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56bd230d5641761d3fcae0d8c536a640_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56bd230d5641761d3fcae0d8c536a640_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 3522⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\56bd230d5641761d3fcae0d8c536a640_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\56bd230d5641761d3fcae0d8c536a640_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 3443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 6283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 6363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 6803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 6803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 8963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 13963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 14083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 14643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 16963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 13963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 16723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 10643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 16923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 736 -ip 7361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1704 -ip 17041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1704 -ip 17041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\56bd230d5641761d3fcae0d8c536a640_NeikiAnalytics.exeFilesize
1.9MB
MD58c9ba78a25e4400eb629eb5bea9dd50b
SHA1feebc2242314f6d360333a462b15a21b706ab65f
SHA256f74867d9fa9dede62c0ca16b127cb6014645881d2ee2c94b7f8adab4a7a6a999
SHA5123b18f7b471871c0b02bc5d94626a166be40a02bc7d4e43b6e606dbd922d45be9af3c097c1086cec6da6f1792cbec8d2c8529abe323e7c8ff1163925fde3fddaf
-
memory/736-0-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/736-6-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1704-7-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1704-8-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1704-14-0x0000000005050000-0x0000000005142000-memory.dmpFilesize
968KB
-
memory/1704-21-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1704-27-0x000000000B980000-0x000000000BA23000-memory.dmpFilesize
652KB