Analysis

  • max time kernel
    123s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 04:10

General

  • Target

    76902c2a6664e240a99584aa3723acb0_NeikiAnalytics.exe

  • Size

    668KB

  • MD5

    76902c2a6664e240a99584aa3723acb0

  • SHA1

    82d876fbb17f8edd8a9c7de682a234796b9a61f2

  • SHA256

    ca388b546acae04c4b4c9f157c9689ff1d6be9eb52e0b5320c43655235dcc997

  • SHA512

    67c4ac7ac651c4d8b76f70dcea391a3836da33955a94683812e9db3388a17aa44dc22894cb9deec8e400466994341822e624e1457530ba7d6a85873fa770fdfb

  • SSDEEP

    12288:bCeM005n6QlJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:GeMUQlJDHUVQ5zg2mblLO3VQ5zxjdgEi

Score
10/10

Malware Config

Signatures

  • Malware Dropper & Backdoor - Berbew 1 IoCs

    Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76902c2a6664e240a99584aa3723acb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\76902c2a6664e240a99584aa3723acb0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\76902c2a6664e240a99584aa3723acb0_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\76902c2a6664e240a99584aa3723acb0_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\76902c2a6664e240a99584aa3723acb0_NeikiAnalytics.exe

    Filesize

    668KB

    MD5

    4da86e472429302cbc309e324a7cddf3

    SHA1

    25727393cf6966513f67a5b65f35aaca326571f6

    SHA256

    0f96fd2f889941b971cb348f85ca51f00d73955af39e67ecb782d45ef1481970

    SHA512

    7d9bdcf46db99f7c91a0f516998cb10b0e03e03568b7cdbdf20c75a305af30992c67ada06188254847e31e8087e05ad472171117c2aa4ccdae2befae3c91c926

  • memory/2956-11-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2956-12-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2956-17-0x0000000000130000-0x0000000000171000-memory.dmp

    Filesize

    260KB

  • memory/2988-0-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2988-5-0x0000000000210000-0x0000000000251000-memory.dmp

    Filesize

    260KB

  • memory/2988-10-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB