Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 04:23

General

  • Target

    NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe

  • Size

    198KB

  • MD5

    f9c003d15298b3c83b9a4b3ae63c34c0

  • SHA1

    0a6810f57f7329445e907afc00baea490cfd0144

  • SHA256

    2cda647d4267e2aad2d6b56e3f7f1c1b071cad6bb9b0843573c81ee724e450a5

  • SHA512

    62624bd46cada26d024212c35ebcbb5bef6856b9cea99b436af153e45737aa5225a2f082a5afab90ef45d7e40007513a4e75fb599f6758d6951bd2f9d7b05cfa

  • SSDEEP

    6144:rgydcWXPlXUVco9v0itBOHhkym/89bKws:rgKPlEVcuSefbj

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs
  • Malware Backdoor - Berbew 13 IoCs

    Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

  • Executes dropped EXE 6 IoCs
  • Drops file in System32 directory 18 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\SysWOW64\Dmcibama.exe
      C:\Windows\system32\Dmcibama.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\Dhhnpjmh.exe
        C:\Windows\system32\Dhhnpjmh.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Windows\SysWOW64\Dobfld32.exe
          C:\Windows\system32\Dobfld32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Windows\SysWOW64\Dhkjej32.exe
            C:\Windows\system32\Dhkjej32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4396
            • C:\Windows\SysWOW64\Dogogcpo.exe
              C:\Windows\system32\Dogogcpo.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3992
              • C:\Windows\SysWOW64\Dmllipeg.exe
                C:\Windows\system32\Dmllipeg.exe
                7⤵
                • Executes dropped EXE
                PID:4380
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 408
                  8⤵
                  • Program crash
                  PID:5000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4380 -ip 4380
    1⤵
      PID:4896

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Dhhnpjmh.exe

      Filesize

      198KB

      MD5

      60ca312a8810731faa00e35c9e978832

      SHA1

      3b9917bc18772ef7619ab29594d26a0154da30df

      SHA256

      3e859fb8b989b2ab8151925123a9a781f8578016428a1d553ded5986c939e778

      SHA512

      59eccd54bcbff84a075a6759bc79d05284c04d3fea2a8c85b2f5808b465a4d0742b0b4ca367260a1bea6b298ab578ac43940b3a1679e1dea8989f67f6a1f2f58

    • C:\Windows\SysWOW64\Dhhnpjmh.exe

      Filesize

      198KB

      MD5

      60ca312a8810731faa00e35c9e978832

      SHA1

      3b9917bc18772ef7619ab29594d26a0154da30df

      SHA256

      3e859fb8b989b2ab8151925123a9a781f8578016428a1d553ded5986c939e778

      SHA512

      59eccd54bcbff84a075a6759bc79d05284c04d3fea2a8c85b2f5808b465a4d0742b0b4ca367260a1bea6b298ab578ac43940b3a1679e1dea8989f67f6a1f2f58

    • C:\Windows\SysWOW64\Dhkjej32.exe

      Filesize

      198KB

      MD5

      c79c055e3266492da68a78fe1d1fd25a

      SHA1

      405859a3ca8ec0ad9c163bc1a30f37436622e8d7

      SHA256

      7761d950a94697e95c18d5be725856096abc6d856ba261ffa9a71d623d795cd8

      SHA512

      d2e68a7cb8742e6f5e4df9c57953828b10d88757f42ae6082efc84a2ada0fae7a57ff27b2173fe84165c131ee2ba7639042eb95f7eccd353fbae294f3ea8139b

    • C:\Windows\SysWOW64\Dhkjej32.exe

      Filesize

      198KB

      MD5

      bc0545df100cf49761196157e087533a

      SHA1

      7b2807f34f241f61003841b61dc430adea27978e

      SHA256

      9d7f2dc1261f05241fceadf54e6f6bb8912f022f101c066fed1b27aa5251a248

      SHA512

      a362477f06a85d049c3f403e507f12355a09ea8aebc1e857422c271bdc20409fb9f0d879c81bb700ae5bc930aa4d6d688c74b48b25aeb4ed4103cca919ad099c

    • C:\Windows\SysWOW64\Dhkjej32.exe

      Filesize

      198KB

      MD5

      bc0545df100cf49761196157e087533a

      SHA1

      7b2807f34f241f61003841b61dc430adea27978e

      SHA256

      9d7f2dc1261f05241fceadf54e6f6bb8912f022f101c066fed1b27aa5251a248

      SHA512

      a362477f06a85d049c3f403e507f12355a09ea8aebc1e857422c271bdc20409fb9f0d879c81bb700ae5bc930aa4d6d688c74b48b25aeb4ed4103cca919ad099c

    • C:\Windows\SysWOW64\Dmcibama.exe

      Filesize

      198KB

      MD5

      3ad39f0c3f548f69cecf431f121afc14

      SHA1

      9d4012501c54339897fb0ac50cc843ab85341835

      SHA256

      92026a8d8f0854c6d593204b72900d94343126514f206b7217b8c3d5c1f1c531

      SHA512

      2eb2e6349ba1f943d8e28cfea21f962a04f892c1c6342d8567c3ab4445470c0cd1819ae8c871544c92f47f997beac0e8e019c993cbb09a94049781c2c7c46298

    • C:\Windows\SysWOW64\Dmcibama.exe

      Filesize

      198KB

      MD5

      3ad39f0c3f548f69cecf431f121afc14

      SHA1

      9d4012501c54339897fb0ac50cc843ab85341835

      SHA256

      92026a8d8f0854c6d593204b72900d94343126514f206b7217b8c3d5c1f1c531

      SHA512

      2eb2e6349ba1f943d8e28cfea21f962a04f892c1c6342d8567c3ab4445470c0cd1819ae8c871544c92f47f997beac0e8e019c993cbb09a94049781c2c7c46298

    • C:\Windows\SysWOW64\Dmllipeg.exe

      Filesize

      198KB

      MD5

      b1b7627907b8885b34336365d89b4be1

      SHA1

      68d4f2d7b3d4cc1a8008d0e50820ab7ff2e5b7f0

      SHA256

      b8ba262674c279e92dddddaef0b9cf2cab41baee451a8315e537266ee7591e2f

      SHA512

      be96e68d44ceb7547a6a76d26e5e0517fd5a1ce87fb970f92fe52c84d9e0f8f3546dafbd215cc8257685efa23e96f2cd263962a9fb4bca4173cbd246dc140837

    • C:\Windows\SysWOW64\Dmllipeg.exe

      Filesize

      198KB

      MD5

      b1b7627907b8885b34336365d89b4be1

      SHA1

      68d4f2d7b3d4cc1a8008d0e50820ab7ff2e5b7f0

      SHA256

      b8ba262674c279e92dddddaef0b9cf2cab41baee451a8315e537266ee7591e2f

      SHA512

      be96e68d44ceb7547a6a76d26e5e0517fd5a1ce87fb970f92fe52c84d9e0f8f3546dafbd215cc8257685efa23e96f2cd263962a9fb4bca4173cbd246dc140837

    • C:\Windows\SysWOW64\Dobfld32.exe

      Filesize

      198KB

      MD5

      c79c055e3266492da68a78fe1d1fd25a

      SHA1

      405859a3ca8ec0ad9c163bc1a30f37436622e8d7

      SHA256

      7761d950a94697e95c18d5be725856096abc6d856ba261ffa9a71d623d795cd8

      SHA512

      d2e68a7cb8742e6f5e4df9c57953828b10d88757f42ae6082efc84a2ada0fae7a57ff27b2173fe84165c131ee2ba7639042eb95f7eccd353fbae294f3ea8139b

    • C:\Windows\SysWOW64\Dobfld32.exe

      Filesize

      198KB

      MD5

      c79c055e3266492da68a78fe1d1fd25a

      SHA1

      405859a3ca8ec0ad9c163bc1a30f37436622e8d7

      SHA256

      7761d950a94697e95c18d5be725856096abc6d856ba261ffa9a71d623d795cd8

      SHA512

      d2e68a7cb8742e6f5e4df9c57953828b10d88757f42ae6082efc84a2ada0fae7a57ff27b2173fe84165c131ee2ba7639042eb95f7eccd353fbae294f3ea8139b

    • C:\Windows\SysWOW64\Dogogcpo.exe

      Filesize

      198KB

      MD5

      4fab8f8fbf4e7fcecf6be41b87b9829b

      SHA1

      4b40a16d4314a8448906b4c5a0c975f42bbf6cdd

      SHA256

      9be55fe9057daf8fcf1105a03ce9026101a994e15dce74982724456aebc31a7d

      SHA512

      e3a1c29bad59d7fe2292ca2b6bbded8d6ab9698404adbf8f671771523da3e652d16ae57bc605e689ed9dd5d6a7cf1fa4638331f80208cb2a4e1fa8ad814bac53

    • C:\Windows\SysWOW64\Dogogcpo.exe

      Filesize

      198KB

      MD5

      4fab8f8fbf4e7fcecf6be41b87b9829b

      SHA1

      4b40a16d4314a8448906b4c5a0c975f42bbf6cdd

      SHA256

      9be55fe9057daf8fcf1105a03ce9026101a994e15dce74982724456aebc31a7d

      SHA512

      e3a1c29bad59d7fe2292ca2b6bbded8d6ab9698404adbf8f671771523da3e652d16ae57bc605e689ed9dd5d6a7cf1fa4638331f80208cb2a4e1fa8ad814bac53

    • C:\Windows\SysWOW64\Lbabpnmn.dll

      Filesize

      7KB

      MD5

      a9b679a4026efd40296982c152384765

      SHA1

      ae9e3d936b48a9008dcd4a8551b709d2cb46d3c2

      SHA256

      854f97d8c6a570d82fa939d39e2d52c0726fe8c6327803767f7c61a032902d2b

      SHA512

      94e60d04876b9afd64668b03e61b42de5c6ca023d623b009e84f3928891a1a4b2ce27cccfe34573c60825c39b89a8ff5faac1238ecbde014b70b89c47774b94f

    • memory/2016-24-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/2016-52-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3124-53-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3124-15-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3516-0-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3516-55-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3992-50-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/3992-39-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4380-48-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4380-49-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4396-51-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4396-32-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4468-12-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4468-54-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB