Overview

overview

10

Static

static

10

88b46c45aa...cs.exe

windows7-x64

10

88b46c45aa...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88b46c45aa0948d3542796af11eb63b0_NeikiAnalytics.exe

  • Size

    89KB

  • Sample

    240604-w5a1ysfd7x

  • MD5

    88b46c45aa0948d3542796af11eb63b0

  • SHA1

    ab9f1ccfc77f9b793bba8c006e0c29538b040f2d

  • SHA256

    8671cec7b9bc3bb213da835bb43a0eddc58591ab0c29ee2533d5870a785f5ee2

  • SHA512

    47bd13e5ef2f8113e59205bce086f1085382a550798c427330f7c366ab3206301111cff3c63cf309e1e16d996de323d73431df9e265d5e164a3c7bd895a98393

  • SSDEEP

    1536:BcuRHPjjXcHHujNpXUYl9elE9LCmzuQ2CK92RQ8D68a+VMKKTRVGFtUhQfR1WRar:SuxjXcHOjNpkYln9LZzuh92edr4MKy32

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      88b46c45aa0948d3542796af11eb63b0_NeikiAnalytics.exe

    • Size

      89KB

    • MD5

      88b46c45aa0948d3542796af11eb63b0

    • SHA1

      ab9f1ccfc77f9b793bba8c006e0c29538b040f2d

    • SHA256

      8671cec7b9bc3bb213da835bb43a0eddc58591ab0c29ee2533d5870a785f5ee2

    • SHA512

      47bd13e5ef2f8113e59205bce086f1085382a550798c427330f7c366ab3206301111cff3c63cf309e1e16d996de323d73431df9e265d5e164a3c7bd895a98393

    • SSDEEP

      1536:BcuRHPjjXcHHujNpXUYl9elE9LCmzuQ2CK92RQ8D68a+VMKKTRVGFtUhQfR1WRar:SuxjXcHOjNpkYln9LZzuh92edr4MKy32

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks