Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 15:36
Behavioral task
behavioral1
Sample
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
-
Size
668KB
-
MD5
0f0425ba536d2a8e3db1a7c4cb407bb0
-
SHA1
79b015ae1aa4229a961b618b73f04fd0dd656a85
-
SHA256
281284c35be2e20e048132b301f22a8b52bd02765504e5a08c6d5d6cfb647ed4
-
SHA512
616adbf84a1e828d7c23aba5aefc1be35ee3f1271d135112e5658654c75e71704c1fc93390bb3dcf32e5606b7981f159b520fcb5d3edc7995571361ca26d6800
-
SSDEEP
12288:CQ/AIykkhwAPlJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:MIy/tPlJDHUVQ5zg2mblLO3VQ5zxjdgx
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe family_berbew -
Deletes itself 1 IoCs
Processes:
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exepid process 2956 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exepid process 2956 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe -
Loads dropped DLL 1 IoCs
Processes:
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exepid process 2024 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exepid process 2024 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exepid process 2956 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exedescription pid process target process PID 2024 wrote to memory of 2956 2024 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe PID 2024 wrote to memory of 2956 2024 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe PID 2024 wrote to memory of 2956 2024 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe PID 2024 wrote to memory of 2956 2024 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exeFilesize
668KB
MD598c4110df9447c175c99daac6a172d17
SHA1220ded955578b8a9756bce60b9d90c1368da0542
SHA256d809612eeda344c2f7084fc60f3e4a2e0ec6eabc812b9d6ce96e5f7c0e7e97f7
SHA512efea2d39c7b2529ff2b8b2331343e85372f45a18e0fcbbd8736329040a9152e8e709039d0daf97d1e902b53f47c61ad3f93cad607d2b3cba656f1fdc4bc4e1d4
-
memory/2024-0-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2024-5-0x00000000001B0000-0x00000000001F1000-memory.dmpFilesize
260KB
-
memory/2024-10-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2956-11-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2956-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2956-17-0x00000000002E0000-0x0000000000321000-memory.dmpFilesize
260KB