Overview

overview

10

Static

static

10

bd4a82c198...cs.exe

windows7-x64

10

bd4a82c198...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd4a82c1980cd8e58150000b2b405c60_NeikiAnalytics.exe

  • Size

    1024KB

  • Sample

    240526-mpt98afc8y

  • MD5

    bd4a82c1980cd8e58150000b2b405c60

  • SHA1

    d03ba7f95b5cb01bec1e690c4a83032bc570aff7

  • SHA256

    5078fe96020b493357cdf09a425705bef7d36cde4dd42220888bff29ac60afa7

  • SHA512

    7d1d928f0bf2cf70237d9bd83be9c319604efd127c11ed10320f360baf241d94256799648284af9e9f7d622fb129d144717a451fb50bc536386b14305b8e1969

  • SSDEEP

    24576:Q99taSHFaZRBEYyqmaf2qwiHPKgRC4gvGZl6snARe:6zaSHFaZRBEYyqmS2DiHPKQgmN

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      bd4a82c1980cd8e58150000b2b405c60_NeikiAnalytics.exe

    • Size

      1024KB

    • MD5

      bd4a82c1980cd8e58150000b2b405c60

    • SHA1

      d03ba7f95b5cb01bec1e690c4a83032bc570aff7

    • SHA256

      5078fe96020b493357cdf09a425705bef7d36cde4dd42220888bff29ac60afa7

    • SHA512

      7d1d928f0bf2cf70237d9bd83be9c319604efd127c11ed10320f360baf241d94256799648284af9e9f7d622fb129d144717a451fb50bc536386b14305b8e1969

    • SSDEEP

      24576:Q99taSHFaZRBEYyqmaf2qwiHPKgRC4gvGZl6snARe:6zaSHFaZRBEYyqmS2DiHPKQgmN

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks