477df16303246d4e77ccdfaa91a4b444ebba5fd41d9e6f205c36975a695a8479

Analysis

max time kernel
143s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
Size

283KB
MD5

2b2311e63e1d4d935a3ade165dd70190
SHA1

1b4318c192c094b0f31d79af87b8a479915f80d8
SHA256

477df16303246d4e77ccdfaa91a4b444ebba5fd41d9e6f205c36975a695a8479
SHA512

62d6d59adee48b30fc61c15734ef3caca4fa6f39c8c2a0edd8fd57a0d97c260cc3df56caf01d20cb679dbec9c9da4e522ba693e38c2d3645be80539bee9d284a
SSDEEP

6144:ycPQ0hIANsZP91hIdXXvsZkT1PNVzSz/Rlc/Th8hylaIqVC/CWPssZkVRnr5:yYGz19funv+kbRSz/PcF8harqVVWPssm

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid process

5084 2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid process

5084 2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1804 5084 WerFault.exe 2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid process

4428 2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid process

5084 2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid	process
5084	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid	process
5084	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid	pid_target	process	target process
1804	5084	WerFault.exe	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid	process
4428	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

pid	process
5084	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

description	pid	process	target process
PID 4428 wrote to memory of 5084	4428	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
PID 4428 wrote to memory of 5084	4428	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
PID 4428 wrote to memory of 5084	4428	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe	2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 364
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4428 -ip 4428
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5084 -ip 5084
1⤵
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2b2311e63e1d4d935a3ade165dd70190_NeikiAnalytics.exe

Filesize
283KB

MD5
75cd27c48fe13336b877480d0de19c93

SHA1
2f4c3ad6f966bacd47de60eaeb80cef735aeffd3

SHA256
87dfdf2229fb1e79d11ad2f9d101e70264d2270bec508f112b66aa4ed464799a

SHA512
1e4ef8309d31739785172094b27e44ff51a9e0b06ebdeb695f9048cddbbce003a14613bae2c6673d78fae793989f24624caa632dade4b904ef199fb77735f4f5

Download Submit
memory/4428-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4428-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5084-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5084-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/5084-13-0x0000000004DF0000-0x0000000004E31000-memory.dmp

Filesize
260KB

Download