Overview

overview

10

Static

static

10

22c144f122...cs.exe

windows7-x64

10

22c144f122...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe

  • Size

    548KB

  • Sample

    240527-g9cm1sbh42

  • MD5

    22c144f122f30f6150b5a1c1a119cb80

  • SHA1

    69748d7beffad46580abaee0d7cd283f8108d9b3

  • SHA256

    71c209d52e208ff5cbb5a5c922e3dc8d47b4d90b34ff3d02851baa8950b5ed2c

  • SHA512

    7cf0fecbc249ba7e8198ff32bca28e8bd4911a7d66e783c35eb36ef7bdd0b38fc1d69c238e14f7f55098b72c2babcccc3abcc25b1231fa6b82cd500eafd26b10

  • SSDEEP

    12288:aNv66IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+C8lM1:Fq5htaSHFaZRBEYyqmaf2qwiHPKgRC45

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe

    • Size

      548KB

    • MD5

      22c144f122f30f6150b5a1c1a119cb80

    • SHA1

      69748d7beffad46580abaee0d7cd283f8108d9b3

    • SHA256

      71c209d52e208ff5cbb5a5c922e3dc8d47b4d90b34ff3d02851baa8950b5ed2c

    • SHA512

      7cf0fecbc249ba7e8198ff32bca28e8bd4911a7d66e783c35eb36ef7bdd0b38fc1d69c238e14f7f55098b72c2babcccc3abcc25b1231fa6b82cd500eafd26b10

    • SSDEEP

      12288:aNv66IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+C8lM1:Fq5htaSHFaZRBEYyqmaf2qwiHPKgRC45

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks