adb0d4b0c3092bfb7e69e85aeeba319da6b2445286f3f6a055d0a95693d63997

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe
Size

1.1MB
MD5

52ce927c21a38ad6b960d4e311598200
SHA1

9ddcb477c487922d325e14aae2ffbe830f115c4c
SHA256

adb0d4b0c3092bfb7e69e85aeeba319da6b2445286f3f6a055d0a95693d63997
SHA512

78447acc1ba1bb87e1a98389f478233e8063ad3b38b1fe8767dea54e5b5cafeeb85e4236557935da5e336aa6e42eaa7d3d9b522bc51ef4a1829777be0a5175d2
SSDEEP

24576:RaOPU8RFH41mM4XmWX+NhC3VLZmN1VUZmc6bo4Sak1UQzF3chFJj9S8bIVm1:RaOPdvmWuNEZmXiZmlk4Sak1UkFsfl9z

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\E975.tmp	family_berbew

Executes dropped EXE 1 IoCs

Processes:

E975.tmp

pid process

2308 E975.tmp

pid	process
2308	E975.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe

description	pid	process	target process
PID 1112 wrote to memory of 2308	1112	52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe	E975.tmp
PID 1112 wrote to memory of 2308	1112	52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe	E975.tmp
PID 1112 wrote to memory of 2308	1112	52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe	E975.tmp

C:\Users\Admin\AppData\Local\Temp\52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\52ce927c21a38ad6b960d4e311598200_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\E975.tmp
  "C:\Users\Admin\AppData\Local\Temp\E975.tmp"
  2⤵
  - Executes dropped EXE
  PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
1⤵
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E975.tmp

Filesize
1.1MB

MD5
b3d36222ff3bcfbc30b0aecd7a3fed6f

SHA1
a84b684f2c504307b8c41975cc66926eafe90cc3

SHA256
3595f887b1ea3d5f1b6c70e16ae4857f976f143d75b404ddd5dad29ec5a722d0

SHA512
6da2b5941fe71a19de7380a95bcf4af7d2e2b9faa4692a64935bb7f90090f04bbc46de5cefc7e74e0da75cc5b2a974117a7de6a973eaef8e232378f3ef8942c3

Download Submit