7d8b4def7f8814fed90911f579ad0adc359f0b49793610c0fc6c1fb3ec0d19ec

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe
Size

955KB
MD5

524effc2f8e5f4eff5444278a9222300
SHA1

c7edca938be2bf03f9728fee995f290b4f5e06a0
SHA256

7d8b4def7f8814fed90911f579ad0adc359f0b49793610c0fc6c1fb3ec0d19ec
SHA512

b778db23da62fdcb32ba68457457a075cbf3bb81f0401db0c237eefb6261f1e408e2345f6cb4c8fbcaa46d4b95da7262b01cc00bea2e75676ee01258a9e125a6
SSDEEP

24576:oTES8M1kLUjqi8bjkDOKz6HtyLZmX1+RnM3L2N9Y3G3wSK6JE4t6FGerrthf:oTESSrbjk5awZmF+RnM3L2N9YWgSK6JW

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2166.tmp	family_berbew

Deletes itself 1 IoCs

Processes:

2166.tmp

pid process

2232 2166.tmp
Executes dropped EXE 1 IoCs

Processes:

2166.tmp

pid process

2232 2166.tmp
Loads dropped DLL 1 IoCs

Processes:

524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe

pid process

2140 524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe

pid	process
2232	2166.tmp

pid	process
2232	2166.tmp

pid	process
2140	524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe

description	pid	process	target process
PID 2140 wrote to memory of 2232	2140	524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe	2166.tmp
PID 2140 wrote to memory of 2232	2140	524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe	2166.tmp
PID 2140 wrote to memory of 2232	2140	524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe	2166.tmp
PID 2140 wrote to memory of 2232	2140	524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe	2166.tmp

C:\Users\Admin\AppData\Local\Temp\524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\524effc2f8e5f4eff5444278a9222300_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Local\Temp\2166.tmp
"C:\Users\Admin\AppData\Local\Temp\2166.tmp"
2⤵
- Deletes itself
- Executes dropped EXE
PID:2232

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2166.tmp
Filesize
955KB

MD5
b5a65ba30829df54bb145177661876da

SHA1
8ecf79fcf996bd579bfd915a8c56021be639b9e2

SHA256
3476f3aa65aad8d8f46b98ea04b7b4d0c69f7ac09d33929ba0fc016154b6c1e8

SHA512
cf415839af4b775c3f718c5d00548d8bd0414ca89a24201ce9923c35dc760e7df4ae9511a84f81ff51181511a37da7c19735378f741cb32b88e9ab9224562e9b

Download Submit