5a263e1964484df64bd2f665f55223967f0e35dd56d90aa944bc31dec84fd4e2

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe
Size

1.3MB
MD5

1fab2c6e63761fb11bfc67073c1a7450
SHA1

2a1700745e6b7bb49cbf63476c6afe2dc9fd2b15
SHA256

5a263e1964484df64bd2f665f55223967f0e35dd56d90aa944bc31dec84fd4e2
SHA512

2dd034d957e2118d89e9a91a22fa6cee03cd1587d2d32be6c2a9af45c70be7aa5234503aba63146fc09b214b6e1459a2e918366363776320ced00d93349db7b4
SSDEEP

24576:qVZj6AR51wrjsOBvpCphWYt/TBb4eBTWa/ZSjXuF77Lv+f6T8Qnskb2i6OBKaBWE:qV8RrJuphWYN9bjQgGXuFbq4TT+E

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral1/files/0x000c00000001450b-4.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
2944	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2944	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2436	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2944	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2944	2436	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe	29
PID 2436 wrote to memory of 2944	2436	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe	29
PID 2436 wrote to memory of 2944	2436	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe	29
PID 2436 wrote to memory of 2944	2436	1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1fab2c6e63761fb11bfc67073c1a7450_NeikiAnalytics.exe

Filesize
1.3MB

MD5
a807a60effe997223b47de56d31ccf95

SHA1
a826746ed7a1f6dd764913db51427557bfc87cf4

SHA256
8bda574d193bdee2b2d9acdf946ec8ef48e9a55202e9b2133ead0ea1ca954f3c

SHA512
e1c4a29aefb9e0b4d9db18e609addb3ef85f504c36da1a242b07ec3bee4f8ed24373995d6da198c543850a6f3a24d22895b5a6a869f267da0cc602de864fdebc

Download Submit
memory/2436-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2436-6-0x0000000002E70000-0x0000000002F5F000-memory.dmp

Filesize
956KB

Download
memory/2436-8-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2944-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2944-17-0x0000000002F60000-0x000000000304F000-memory.dmp

Filesize
956KB

Download
memory/2944-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2944-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2944-39-0x000000000FEB0000-0x000000000FF53000-memory.dmp

Filesize
652KB

Download
memory/2944-40-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download