Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 00:03
Behavioral task
behavioral1
Sample
6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe
-
Size
448KB
-
MD5
6e3060e0283732ab49c445ab40128470
-
SHA1
7b2abd49eea3dc18b2032f965944338a93e8efba
-
SHA256
cd9fb30ef57e1c6e3b294282f81f5aee65f508f4d63956dc36a6927164d68a8c
-
SHA512
6acf5b912998691053c3907f36edbac9cf81240f04ff4076f25fc13008acc79a845f770901c20f8612d091d65794ec4254a70a3ee0cf229ef716a944420a256f
-
SSDEEP
12288:1AQ6jn2Hk0ftYmI1TCU4rWNSIOsbJBsbrgAeCiIMiFkmZzcukG2/:1/672HkKtYmI1TCONSIT4gAeCiITzcui
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\system\JJQLUUH.exe family_berbew -
Executes dropped EXE 1 IoCs
Processes:
JJQLUUH.exepid process 2700 JJQLUUH.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2620 cmd.exe 2620 cmd.exe -
Drops file in Windows directory 3 IoCs
Processes:
6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exedescription ioc process File created C:\windows\system\JJQLUUH.exe 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe File opened for modification C:\windows\system\JJQLUUH.exe 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe File created C:\windows\system\JJQLUUH.exe.bat 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exeJJQLUUH.exepid process 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe 2700 JJQLUUH.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exeJJQLUUH.exepid process 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe 2700 JJQLUUH.exe 2700 JJQLUUH.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6e3060e0283732ab49c445ab40128470_NeikiAnalytics.execmd.exedescription pid process target process PID 1956 wrote to memory of 2620 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe cmd.exe PID 1956 wrote to memory of 2620 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe cmd.exe PID 1956 wrote to memory of 2620 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe cmd.exe PID 1956 wrote to memory of 2620 1956 6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe cmd.exe PID 2620 wrote to memory of 2700 2620 cmd.exe JJQLUUH.exe PID 2620 wrote to memory of 2700 2620 cmd.exe JJQLUUH.exe PID 2620 wrote to memory of 2700 2620 cmd.exe JJQLUUH.exe PID 2620 wrote to memory of 2700 2620 cmd.exe JJQLUUH.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e3060e0283732ab49c445ab40128470_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\windows\system\JJQLUUH.exe.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\JJQLUUH.exeC:\windows\system\JJQLUUH.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD56b74cf62447d2f49a48893accd534a24
SHA1b140b686cacd800e63cea568be1d114295b6230f
SHA25678fd6e44f18d825414ef4d2eb50e1c45d5f295bbd133014f5053a678933fece8
SHA51246fcaead21a08a5ac60fdd17c15c62db1fd590ce08d612e7e79066e83871f0948977e0d35875644902690f93cb476325af6646d580f577ed5aa7fb7178c6d735
-
Filesize
74B
MD5719689086c256b1dc4251bb1b8233b6a
SHA14cfebb108f9f0d6d276d8d90757c0588ba7d7c32
SHA256acbe151748a254b39b811b384264bed6320adf66691eda2d0affc40bbca3cd34
SHA5120662b51258a0a7c0bef3cd4a5e03787d551ea8fe006ff52e30e5c5aed04b7a0876d478ed5c983762ec946337c18c42c65f1010144e48b315e4b19d9caa3a0fb7