281284c35be2e20e048132b301f22a8b52bd02765504e5a08c6d5d6cfb647ed4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
Size

668KB
MD5

0f0425ba536d2a8e3db1a7c4cb407bb0
SHA1

79b015ae1aa4229a961b618b73f04fd0dd656a85
SHA256

281284c35be2e20e048132b301f22a8b52bd02765504e5a08c6d5d6cfb647ed4
SHA512

616adbf84a1e828d7c23aba5aefc1be35ee3f1271d135112e5658654c75e71704c1fc93390bb3dcf32e5606b7981f159b520fcb5d3edc7995571361ca26d6800
SSDEEP

12288:CQ/AIykkhwAPlJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:MIy/tPlJDHUVQ5zg2mblLO3VQ5zxjdgx

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid process

560 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid process

560 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid	process
560	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid	process
560	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4428	2004	WerFault.exe	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
1232	560	WerFault.exe	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid process

2004 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid process

560 0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid	process
2004	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

pid	process
560	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

description	pid	process	target process
PID 2004 wrote to memory of 560	2004	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
PID 2004 wrote to memory of 560	2004	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
PID 2004 wrote to memory of 560	2004	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe	0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 376
2⤵
- Program crash
PID:4428

C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 368
3⤵
- Program crash
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2004 -ip 2004
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 560 -ip 560
1⤵
PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0f0425ba536d2a8e3db1a7c4cb407bb0_NeikiAnalytics.exe
Filesize
668KB

MD5
d6bbbf48fdc57f5a8bc4f46d2a9e2096

SHA1
d9fd5968ff13817ea3106dffc6cd2dcfde9fb8dc

SHA256
97e01ebd92d3cfd37a6926b6cf77b2c222e9610d5fb6d24a74dcb070a94bc3d9

SHA512
c147efb919deec6bcf55a99d2cfa8426e7490928483bd3d699e45f3c722f748709cd465841998873521362beff562205b54939ebc0e91c9df07d8f0c556a0cf4

Download Submit
memory/560-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/560-13-0x00000000014D0000-0x0000000001511000-memory.dmp

Filesize
260KB

Download
memory/2004-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2004-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download