52d28be0b2e08b61e6d915601f2764feb6e25b21deef3da4d42bea9daa4d81bf

Analysis

max time kernel
111s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
Size

283KB
MD5

67a98da969e21a2bf0b68be1195e7590
SHA1

4f1c42f125a9035e07ffc53facca32e812af0f24
SHA256

52d28be0b2e08b61e6d915601f2764feb6e25b21deef3da4d42bea9daa4d81bf
SHA512

9292adc7b07afb8370afe006a8fbb92c3a729e8932d8b8e7086fed283c80e41cc578ac5bde68d8a48a53031033d0ca4441203104d1c54c287e257350529fa13d
SSDEEP

6144:qnLlpesvzVsAbs3P7nIjBzMGvWpZQa95wV2YjJi/l+uBaWvtg7bpAq3t2hKhUhHS:Ql0kVY3TmZhoZ/9uV2YjJi/l+uBaWvti

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid process

2444 67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid process

2444 67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid	process
2444	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid	process
2444	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1136	1848	WerFault.exe	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
4500	2444	WerFault.exe	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid process

1848 67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid process

2444 67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid	process
1848	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

pid	process
2444	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

description	pid	process	target process
PID 1848 wrote to memory of 2444	1848	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
PID 1848 wrote to memory of 2444	1848	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
PID 1848 wrote to memory of 2444	1848	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe	67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 396
2⤵
- Program crash
PID:1136

C:\Users\Admin\AppData\Local\Temp\67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 364
3⤵
- Program crash
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1848 -ip 1848
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2444 -ip 2444
1⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67a98da969e21a2bf0b68be1195e7590_NeikiAnalytics.exe
Filesize
283KB

MD5
a0a7585d727579ac3c23ad05cd5e4142

SHA1
1cf93c540e4b9bf39bc9be6a53605c91fa95e0df

SHA256
7107bc864e546c873bee1da874750c11452f0c2931053e91a2532b49ac86b58a

SHA512
639900899fff8807c3b466e7734cfa57cbd9a2c2aee275c5f79c866c04d3ba51026aed18a684c099d055f0432f552b9087fdfb9568eae7dd52ef31670c932dc3

Download Submit
memory/1848-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1848-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2444-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2444-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2444-13-0x00000000014B0000-0x00000000014F1000-memory.dmp

Filesize
260KB

Download