fe0d7947d63d183f3a258806fef9a8e9540fc00b6d69f5c39d8995c8d5729e91

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Size

991KB
MD5

4a7de389c2f9e29ab77903df3a01ca00
SHA1

b0d93b3fdcff0c84ebf1703d57612bba5fc610e8
SHA256

fe0d7947d63d183f3a258806fef9a8e9540fc00b6d69f5c39d8995c8d5729e91
SHA512

9e753daf609d423dfc79ffb64cb1f13bff457b894526418ab5fe4243e5279effbde5fb11cd86a579518d53ba9e3456bbb8dc07f8689b45fd6ca379e032c1120e
SSDEEP

24576:rCWdZ7mzEyqAWVk4+5Rphmct+OlISoNa/ZSMQugi8ndZ5G:rC+tmYO+k4K/tIioNg1Qugi8ndZ5G

Score

10^/10

backdoor dropper trojan

Malware Config

Signatures

Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
backdoor trojan dropper

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe family_berbew
Deletes itself 1 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid process

1840 4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid process

1840 4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Loads dropped DLL 1 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid process

2268 4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 pastebin.com
4 pastebin.com

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe	family_berbew

pid	process
1840	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid	process
1840	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid	process
2268	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

flow	ioc
3	pastebin.com
4	pastebin.com

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid process

1840 4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid process

2268 4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid process

1840 4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid	process
1840	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid	process
2268	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

pid	process
1840	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

description	pid	process	target process
PID 2268 wrote to memory of 1840	2268	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
PID 2268 wrote to memory of 1840	2268	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
PID 2268 wrote to memory of 1840	2268	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
PID 2268 wrote to memory of 1840	2268	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe	4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4a7de389c2f9e29ab77903df3a01ca00_NeikiAnalytics.exe
Filesize
991KB

MD5
3a47702af89dc7623ed3ad42e9b8866e

SHA1
421740ebc947f643f605114b2e9e34ea1f83e331

SHA256
1af2b416e905b70f7a924f821fb57ff21568719902bd8196c1e7daf4fac41ce0

SHA512
9284c9091f5cdc3683da3ef398db3156e5cd6c8ef98ee39882e83fadb4b1e8f49ea15cf94d07d16189b05c53c77b4cff75f9e5a5eee9896cae268e305ef382c0

Download Submit
memory/1840-17-0x0000000002F40000-0x0000000003035000-memory.dmp

Filesize
980KB

Download
memory/1840-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1840-10-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1840-51-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1840-57-0x000000000DEC0000-0x000000000DF63000-memory.dmp

Filesize
652KB

Download
memory/2268-0-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2268-9-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2268-7-0x0000000003190000-0x0000000003285000-memory.dmp

Filesize
980KB

Download