Analysis Overview
SHA256
25c2697760f10efcdfab6e2f44ce1aacc322f0a8f7130cabcdfd3006d239ce88
Threat Level: Known bad
The file 409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe was found to be: Known bad.
Malicious Activity Summary
Berbew family
Malware Dropper & Backdoor - Berbew
Deletes itself
Loads dropped DLL
Executes dropped EXE
Program crash
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious behavior: RenamesItself
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-06-02 05:36
Signatures
Berbew family
Malware Dropper & Backdoor - Berbew
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-02 05:36
Reported
2024-06-02 05:38
Platform
win10v2004-20240426-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
Malware Dropper & Backdoor - Berbew
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Program crash
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5112 wrote to memory of 3688 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
| PID 5112 wrote to memory of 3688 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
| PID 5112 wrote to memory of 3688 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 344
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3688 -ip 3688
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 344
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3688 -ip 3688
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 164
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp |
Files
memory/5112-0-0x0000000000400000-0x00000000004F0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
| MD5 | b9edc76021c57ba6430aec098b1c0c6f |
| SHA1 | d48446041e1df1a4f4d80da7033adf6ee042bc2f |
| SHA256 | 9b238144a691f9274dc5fb8aa9f8c08c3332fc7b2edf7aea703016ed0e6f54c2 |
| SHA512 | c9866f2f2970b311a895c6671a77dddcefa8c94736223bec836e9fa8c0df73d72ac09bce2df9a721bef7cc95d2d20d0ce5cb205aed2ecb265fb16fb59a8a43e7 |
memory/5112-6-0x0000000000400000-0x00000000004F0000-memory.dmp
memory/3688-7-0x0000000000400000-0x00000000004F0000-memory.dmp
memory/3688-8-0x0000000000400000-0x00000000004F0000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-02 05:36
Reported
2024-06-02 05:38
Platform
win7-20240221-en
Max time kernel
120s
Max time network
125s
Command Line
Signatures
Malware Dropper & Backdoor - Berbew
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1440 wrote to memory of 2504 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
| PID 1440 wrote to memory of 2504 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
| PID 1440 wrote to memory of 2504 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
| PID 1440 wrote to memory of 2504 | N/A | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe | C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
Network
Files
memory/1440-0-0x0000000000400000-0x00000000004F0000-memory.dmp
\Users\Admin\AppData\Local\Temp\409e581ce0b80f97a7a58ea14da96060_NeikiAnalytics.exe
| MD5 | d1a13fef27c9c8a7f19542f0f3cfef47 |
| SHA1 | e4ddab7fa1f0c6c68922954a50abfa3cf405d3bd |
| SHA256 | 13d8441c32fa49febd0eb31a086cff1257c2890ee84ee8f8b87182fe9dafe696 |
| SHA512 | 42405a1f0dc317332f7ac99a7861f4a88489777466517ad14f4f03a1c420e2d16fce281fd91cafc5db894619b0482e2ecf0a3e11fdd5719341758997d5259011 |
memory/1440-7-0x0000000000400000-0x00000000004F0000-memory.dmp
memory/2504-9-0x0000000000400000-0x00000000004F0000-memory.dmp
memory/2504-10-0x0000000000400000-0x00000000004F0000-memory.dmp