Analysis
-
max time kernel
139s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 01:10
Behavioral task
behavioral1
Sample
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe
-
Size
439KB
-
MD5
23bd47304dad95679c9d38211c62b670
-
SHA1
335e60012895c3e37080b9ee82c1d72bbc5b286f
-
SHA256
7d0c92ca39fe2726aa5ca948b827aacdeac37a501e6236a86a148d6ec0e8d88e
-
SHA512
2fb27cb1b945f1e59d8a927017e1a02b61b6a7a390a7f2dd6875a754055d820247860c6096527e2879ff55de176a20b7070240132f15a5c0629e94b02401b2e4
-
SSDEEP
12288:Dr7wyBGbUZZn1tA5iL8On41iNG7qyk2Rq5GjF6r9sGN5DoDn+c:f7wCGbUZZn1tA5iL8On41iNG7qyk2Rqm
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe family_berbew -
Deletes itself 1 IoCs
Processes:
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exepid process 2856 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exepid process 2856 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3504 4384 WerFault.exe 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe 2684 2856 WerFault.exe 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exepid process 4384 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exepid process 2856 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exedescription pid process target process PID 4384 wrote to memory of 2856 4384 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe PID 4384 wrote to memory of 2856 4384 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe PID 4384 wrote to memory of 2856 4384 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe 23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 3962⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 3643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4384 -ip 43841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2856 -ip 28561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\23bd47304dad95679c9d38211c62b670_NeikiAnalytics.exeFilesize
439KB
MD5b6b6ff20dc310788366db1d7a357c322
SHA1590b345164614f86ea20b1a9f9bb587b59905d79
SHA256bce7b522cbcff463cf2abc5de6f678970d5b86336f209fde2f230468ff3c1eb9
SHA51261b40beda154eaeb98afee470b9ba6b66b98590707b5e3ad46669f4dfbcbf8645ad9a941c3bf10c3363cd93ea2f1eaff56f5baa0d673fac400ae5613df64d64b
-
memory/2856-6-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2856-9-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2856-14-0x00000000015E0000-0x0000000001617000-memory.dmpFilesize
220KB
-
memory/4384-0-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4384-8-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB