b3bf84686b62d54389731927a5b5fecba692c8bc83669f44abbe4a7b9468ece6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
Size

453KB
MD5

04267745d58311b886090aa01c85b670
SHA1

6b4fd20ffb84c66a63cbaf8b5df79e2610dba9d9
SHA256

b3bf84686b62d54389731927a5b5fecba692c8bc83669f44abbe4a7b9468ece6
SHA512

86e1259e7e0f78b9c593686b31fe403c2dca52d4ddca3818e37656a87ef683e65ad3cefcc6d704169c50b8bb50328671d6edc305f07bafd019044bab9783e9d4
SSDEEP

12288:gm8fnDCRarHnpsOLu9nVlEoLLWx0kW1qOK6HGaatleRfy9CntrC:dwHnpsOLu9nVlEoLLWx0kW1qOK6HGaal

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\04267745d58311b886090aa01c85b670_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid process

2960 04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid process

2960 04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
Loads dropped DLL 1 IoCs

Processes:

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid process

2220 04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid process

2220 04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid process

2960 04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid	process
2960	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid	process
2960	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid	process
2220	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid	process
2220	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

pid	process
2960	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

description	pid	process	target process
PID 2220 wrote to memory of 2960	2220	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
PID 2220 wrote to memory of 2960	2220	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
PID 2220 wrote to memory of 2960	2220	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
PID 2220 wrote to memory of 2960	2220	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe	04267745d58311b886090aa01c85b670_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04267745d58311b886090aa01c85b670_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\04267745d58311b886090aa01c85b670_NeikiAnalytics.exe
Filesize
453KB

MD5
ee7553622a6bb3403af0304226545efd

SHA1
1be72a0ca08bd63722c0bf962578d510bd11873b

SHA256
934dd78b6d85fb0e1728acd2f9b3305a3553ff75f8eb9cdabc42e11432815cbb

SHA512
adcb3cba29ab58770c2df7d56894d935a455bb4447e4d2565ef1ff209f727e57aa6405d060c2ab534af1accad978f6e86f52b831012d86bfe1cf246c05fe4c23

Download Submit
memory/2220-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2220-6-0x0000000000130000-0x000000000016A000-memory.dmp

Filesize
232KB

Download
memory/2220-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2960-11-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2960-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2960-17-0x00000000001B0000-0x00000000001EA000-memory.dmp

Filesize
232KB

Download