Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 15:30
Behavioral task
behavioral1
Sample
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe
-
Size
346KB
-
MD5
0f90055f8742415b5ae99f63da7b3e20
-
SHA1
8e4ce5fe62e2e8b7b070b0904b5209204bf9417a
-
SHA256
f2ebbacb5dd2f2afb7609c65d381e1b0c895e72f08a6c28e01fbdfc4a569eb2c
-
SHA512
96c6a9d54263adbc3c8c902268a3946f7cac3b1f55e9139d060f60c6e1e624308b8079ccb75d1ee9b0fac03d873b5f3a565dc9c8a4bc0589bf1986c3ae31a4c4
-
SSDEEP
3072:2awGlHPsPgU5QdDrFDHZtObmOm3AIpwbjshrmP24ho1mtye3lFDrFDHZtOk6Tsos:vwgv2ho5t13LJhrmMsFj5tzOvfFOM6
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe -
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Iagfoe32.exe family_berbew -
Executes dropped EXE 1 IoCs
Processes:
Iagfoe32.exepid process 3060 Iagfoe32.exe -
Loads dropped DLL 6 IoCs
Processes:
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exeWerFault.exepid process 2180 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe 2180 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe -
Drops file in System32 directory 3 IoCs
Processes:
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Iagfoe32.exe 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Iagfoe32.exe 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Gjenmobn.dll 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2668 3060 WerFault.exe Iagfoe32.exe -
Modifies registry class 6 IoCs
Processes:
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjenmobn.dll" 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exeIagfoe32.exedescription pid process target process PID 2180 wrote to memory of 3060 2180 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Iagfoe32.exe PID 2180 wrote to memory of 3060 2180 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Iagfoe32.exe PID 2180 wrote to memory of 3060 2180 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Iagfoe32.exe PID 2180 wrote to memory of 3060 2180 0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe Iagfoe32.exe PID 3060 wrote to memory of 2668 3060 Iagfoe32.exe WerFault.exe PID 3060 wrote to memory of 2668 3060 Iagfoe32.exe WerFault.exe PID 3060 wrote to memory of 2668 3060 Iagfoe32.exe WerFault.exe PID 3060 wrote to memory of 2668 3060 Iagfoe32.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f90055f8742415b5ae99f63da7b3e20_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\Iagfoe32.exeC:\Windows\system32\Iagfoe32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1403⤵
- Loads dropped DLL
- Program crash
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
346KB
MD5e6e24f99c80dc2528b66d4b03d7384cd
SHA14f5c99c257f0975b9e78b774d003a37086f983c1
SHA2560253ede6052cd59f05164fb4d750460190315b10b9164a331dfba9bc74032246
SHA512bc33da961fa6a538d96a75cc8cc486f94e5bcc20025b4810a90feee15adf4f098abab3eea624afe385c0960dee7646477d0674b163ecd6eb4bbcb837761e55d4