Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-06-2024 01:10
General
-
Target
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe
-
Size
439KB
-
MD5
23bd47304dad95679c9d38211c62b670
-
SHA1
335e60012895c3e37080b9ee82c1d72bbc5b286f
-
SHA256
7d0c92ca39fe2726aa5ca948b827aacdeac37a501e6236a86a148d6ec0e8d88e
-
SHA512
2fb27cb1b945f1e59d8a927017e1a02b61b6a7a390a7f2dd6875a754055d820247860c6096527e2879ff55de176a20b7070240132f15a5c0629e94b02401b2e4
-
SSDEEP
12288:Dr7wyBGbUZZn1tA5iL8On41iNG7qyk2Rq5GjF6r9sGN5DoDn+c:f7wCGbUZZn1tA5iL8On41iNG7qyk2Rqm
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exeFilesize
439KB
MD55be0887ea5afe66bcd379e18229c1d89
SHA15b656cb266448b8cfab754793886fe027fddde4e
SHA256a1d206d2830cfbe2aea6bb5b4a933f9b68adf8d06ec4aa8b259d5523595df64c
SHA51295de0d16c95e4c0639b86ee73bcc9ebb2214319fafd4e4f9ae4a53455eb54d74f9227f093ff3ae14ec2065e23785a09f74d249c92d342c25e98ca685c43838a3
-
memory/2632-13-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2632-18-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2632-17-0x0000000000130000-0x0000000000167000-memory.dmpFilesize
220KB
-
memory/2868-0-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2868-5-0x0000000000130000-0x0000000000167000-memory.dmpFilesize
220KB
-
memory/2868-11-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB