74b329f07e18d941245e3900201e28bd6f847090bdea57becec014d88892875d

General

Target

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
Size

1.3MB
MD5

4483fa9e96a222c83c1ec2d618de61e0
SHA1

bf597b148ba99e9915ac0a17ff6c120c5d9a31a7
SHA256

74b329f07e18d941245e3900201e28bd6f847090bdea57becec014d88892875d
SHA512

bc6d802f75e0f4d9f0560df2b0308a828837f64cce579ddf629f379ef504c5100d565f73166603d383892a595e463453b49424a3c9fb319097cc43ce301449f2
SSDEEP

24576:DfAEerrf5D+daoyUTIYKE4+j2m/F3Ia/ZSjXuF77Lv+f6T8Qnskb2i6OBKaBWvM:EEy5D+U1YjegGXuFbq4TT+E

Score

10^/10

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe	family_berbew

Deletes itself 1 IoCs

Processes:

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid process

4460 4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid process

4460 4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

14 pastebin.com
16 pastebin.com

pid	process
4460	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid	process
4460	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

flow	ioc
14	pastebin.com
16	pastebin.com

Program crash 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
972	1336	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
4676	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
4108	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2524	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2876	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
800	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2700	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
3256	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
372	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
1520	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2412	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
3920	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2152	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
4600	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2280	4460	WerFault.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid process

4460 4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
4460 4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid process

1336 4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid process

4460 4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid	process
4460	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
4460	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid	process
1336	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

pid	process
4460	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

description	pid	process	target process
PID 1336 wrote to memory of 4460	1336	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
PID 1336 wrote to memory of 4460	1336	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
PID 1336 wrote to memory of 4460	1336	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe	4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 344
2⤵
- Program crash
PID:972

C:\Users\Admin\AppData\Local\Temp\4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 352
3⤵
- Program crash
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 628
3⤵
- Program crash
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 628
3⤵
- Program crash
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 628
3⤵
- Program crash
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 720
3⤵
- Program crash
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 904
3⤵
- Program crash
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1404
3⤵
- Program crash
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1448
3⤵
- Program crash
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1468
3⤵
- Program crash
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1524
3⤵
- Program crash
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1484
3⤵
- Program crash
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1528
3⤵
- Program crash
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1640
3⤵
- Program crash
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 632
3⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1336 -ip 1336
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4460 -ip 4460
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4460 -ip 4460
1⤵
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4460 -ip 4460
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4460 -ip 4460
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4460 -ip 4460
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4460 -ip 4460
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4460 -ip 4460
1⤵
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4460 -ip 4460
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4460 -ip 4460
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4460 -ip 4460
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4460 -ip 4460
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4460 -ip 4460
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4483fa9e96a222c83c1ec2d618de61e0_NeikiAnalytics.exe
Filesize
1.3MB

MD5
d53ed1bc455dd9fdd4fffa8b1d45a97f

SHA1
50ace775abe070f98df2423fd2938108487c9c69

SHA256
a38ee5aee8c48c55ba95fdf98c00f57d2c891f0b2c3e2bf53acb00a1a9a2785e

SHA512
0ea18cc117c65807226c7e598248173bb279d7a6792854914d914253a40156dc8a6db2ee8c8382e893bf7d25707b7b885d12eeb3b4dbf8bc8c13cec8e8d7d16e

Download Submit
memory/1336-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1336-5-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4460-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4460-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4460-14-0x0000000004FD0000-0x00000000050BF000-memory.dmp

Filesize
956KB

Download
memory/4460-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4460-27-0x000000000B970000-0x000000000BA13000-memory.dmp

Filesize
652KB

Download
memory/4460-28-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads