2d8698f84ada9faa1ffa836b7cd92107e44018979b1c6ac5cc0ca1efbaacc1d8

General

Target

1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe
Size

772KB
MD5

1e2660d4b58cd139f2e3f76d039c64b0
SHA1

a57f0975a17a9909e73b6e945a7f364b396036f2
SHA256

2d8698f84ada9faa1ffa836b7cd92107e44018979b1c6ac5cc0ca1efbaacc1d8
SHA512

0922d6483eaca4ac39bf53126c847ecfbaf0ea3a2888c7339df4a73e379d387ee3c2b99e30283b26de1e74566b888e25100b15419760c8f36040cdc4c6fd95df
SSDEEP

24576:qW298E8u94hQZTZ5spa+qmd6f5HpmwhNeZLLGDtEC5AoFhR4gNUagtu:a98E8uS8cpa+qmd6flpmkNeZ/GDtEC59

Score

10^/10

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\41BC.tmp	family_berbew

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

41BC.tmp

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 41BC.tmp
Executes dropped EXE 1 IoCs

Processes:

41BC.tmp

pid process

4876 41BC.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	41BC.tmp

pid	process
4876	41BC.tmp

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

41BC.tmp

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 41BC.tmp
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

804 WINWORD.EXE
804 WINWORD.EXE
Suspicious behavior: RenamesItself 1 IoCs

Processes:

41BC.tmp

pid process

4876 41BC.tmp

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	41BC.tmp

pid	process
4876	41BC.tmp

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe41BC.tmp

description	pid	process	target process
PID 4224 wrote to memory of 4876	4224	1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe	41BC.tmp
PID 4224 wrote to memory of 4876	4224	1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe	41BC.tmp
PID 4224 wrote to memory of 4876	4224	1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe	41BC.tmp
PID 4876 wrote to memory of 804	4876	41BC.tmp	WINWORD.EXE
PID 4876 wrote to memory of 804	4876	41BC.tmp	WINWORD.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224

C:\Users\Admin\AppData\Local\Temp\41BC.tmp
"C:\Users\Admin\AppData\Local\Temp\41BC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.exe 192BBA533D03E5144A2243DD8C8944F866E2F119F2F64E6FD5922A9E4BD1DE868F2C6E332422AD16FC522419AFAA50FA64BB4CEBBA7E64E027EE7944A8785D10
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4876

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.docx" /o ""
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1e2660d4b58cd139f2e3f76d039c64b0_NeikiAnalytics.docx
Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
C:\Users\Admin\AppData\Local\Temp\41BC.tmp
Filesize
772KB

MD5
ef4931ab810027dc93173e44dea60d28

SHA1
b5a3d7207565060cd1bce133031a0fd5890556a4

SHA256
e99b17ad4f4ac66373aa60d82b29d7b49523127ce6d323cbcded22ef4ba68285

SHA512
0d4ceb22e9f24bf1358ca4205b39840ce5593c4cc4d93233116f61b974f495ef3ed97529d19dda3c76487297b1c287722ba8ed052e2888286db4e8b681219fb8

Download Submit
memory/804-11-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

Filesize
64KB

Download
memory/804-20-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-15-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-16-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

Filesize
64KB

Download
memory/804-13-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

Filesize
64KB

Download
memory/804-12-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

Filesize
64KB

Download
memory/804-9-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

Filesize
64KB

Download
memory/804-10-0x00007FFD26E4D000-0x00007FFD26E4E000-memory.dmp

Filesize
4KB

Download
memory/804-17-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-14-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-19-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-18-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-21-0x00007FFCE46E0000-0x00007FFCE46F0000-memory.dmp

Filesize
64KB

Download
memory/804-22-0x00007FFCE46E0000-0x00007FFCE46F0000-memory.dmp

Filesize
64KB

Download
memory/804-38-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download
memory/804-39-0x00007FFD26E4D000-0x00007FFD26E4E000-memory.dmp

Filesize
4KB

Download
memory/804-40-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads