Overview

overview

10

Static

static

10

13f0689e5e...cs.exe

windows7-x64

10

13f0689e5e...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13f0689e5e74610a9649152e0bb2c380_NeikiAnalytics.exe

  • Size

    229KB

  • Sample

    240526-t3m7dsde98

  • MD5

    13f0689e5e74610a9649152e0bb2c380

  • SHA1

    4afdf0c57d48bbf3a2f1d134213e1e76b16edd62

  • SHA256

    a7edf9c6d632c201e2e07c15918331efde5f42c69e67c7048bc0883bd42fb64f

  • SHA512

    85d339f3ebd8c7e3dae8fa83de900dacb320d291cac05428a294807ab95f4ef6a6d9b0e5586e8eb9404927ed77e3ce8f7146e800525e3700ab5aeb3ec8b6b743

  • SSDEEP

    3072:/odKIR9xI/GLBHDdSfU27jxEZHR3/pvkqrifbdB7dYk1Bx8DpsV6YZOwVTNhCKdo:AhBEM271+HZ/pvkym/89bYEwPhCKvav

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      13f0689e5e74610a9649152e0bb2c380_NeikiAnalytics.exe

    • Size

      229KB

    • MD5

      13f0689e5e74610a9649152e0bb2c380

    • SHA1

      4afdf0c57d48bbf3a2f1d134213e1e76b16edd62

    • SHA256

      a7edf9c6d632c201e2e07c15918331efde5f42c69e67c7048bc0883bd42fb64f

    • SHA512

      85d339f3ebd8c7e3dae8fa83de900dacb320d291cac05428a294807ab95f4ef6a6d9b0e5586e8eb9404927ed77e3ce8f7146e800525e3700ab5aeb3ec8b6b743

    • SSDEEP

      3072:/odKIR9xI/GLBHDdSfU27jxEZHR3/pvkqrifbdB7dYk1Bx8DpsV6YZOwVTNhCKdo:AhBEM271+HZ/pvkym/89bYEwPhCKvav

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks