Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 04:23
Behavioral task
behavioral1
Sample
NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe
-
Size
198KB
-
MD5
f9c003d15298b3c83b9a4b3ae63c34c0
-
SHA1
0a6810f57f7329445e907afc00baea490cfd0144
-
SHA256
2cda647d4267e2aad2d6b56e3f7f1c1b071cad6bb9b0843573c81ee724e450a5
-
SHA512
62624bd46cada26d024212c35ebcbb5bef6856b9cea99b436af153e45737aa5225a2f082a5afab90ef45d7e40007513a4e75fb599f6758d6951bd2f9d7b05cfa
-
SSDEEP
6144:rgydcWXPlXUVco9v0itBOHhkym/89bKws:rgKPlEVcuSefbj
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhkjej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhkjej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmcibama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dobfld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhhnpjmh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dobfld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dogogcpo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dmcibama.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhhnpjmh.exe -
Malware Backdoor - Berbew 13 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0002000000022612-6.dat family_berbew behavioral2/files/0x0002000000022612-7.dat family_berbew behavioral2/files/0x0008000000022dd1-14.dat family_berbew behavioral2/files/0x0008000000022dd1-16.dat family_berbew behavioral2/files/0x0007000000022dd6-22.dat family_berbew behavioral2/files/0x0007000000022dd6-23.dat family_berbew behavioral2/files/0x0007000000022dd8-25.dat family_berbew behavioral2/files/0x0007000000022dd8-30.dat family_berbew behavioral2/files/0x0007000000022dd8-31.dat family_berbew behavioral2/files/0x0007000000022dda-38.dat family_berbew behavioral2/files/0x0007000000022dda-40.dat family_berbew behavioral2/files/0x0007000000022ddc-46.dat family_berbew behavioral2/files/0x0007000000022ddc-47.dat family_berbew -
Executes dropped EXE 6 IoCs
pid Process 4468 Dmcibama.exe 3124 Dhhnpjmh.exe 2016 Dobfld32.exe 4396 Dhkjej32.exe 3992 Dogogcpo.exe 4380 Dmllipeg.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe Dogogcpo.exe File created C:\Windows\SysWOW64\Kngpec32.dll Dogogcpo.exe File created C:\Windows\SysWOW64\Dmllipeg.exe Dogogcpo.exe File created C:\Windows\SysWOW64\Dogogcpo.exe Dhkjej32.exe File opened for modification C:\Windows\SysWOW64\Dogogcpo.exe Dhkjej32.exe File created C:\Windows\SysWOW64\Lbabpnmn.dll Dhkjej32.exe File created C:\Windows\SysWOW64\Dhhnpjmh.exe Dmcibama.exe File created C:\Windows\SysWOW64\Alcidkmm.dll Dhhnpjmh.exe File created C:\Windows\SysWOW64\Dhkjej32.exe Dobfld32.exe File created C:\Windows\SysWOW64\Jbpbca32.dll Dobfld32.exe File created C:\Windows\SysWOW64\Nbgngp32.dll Dmcibama.exe File created C:\Windows\SysWOW64\Dobfld32.exe Dhhnpjmh.exe File opened for modification C:\Windows\SysWOW64\Dobfld32.exe Dhhnpjmh.exe File opened for modification C:\Windows\SysWOW64\Dhkjej32.exe Dobfld32.exe File created C:\Windows\SysWOW64\Dmcibama.exe NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe File opened for modification C:\Windows\SysWOW64\Dmcibama.exe NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe File created C:\Windows\SysWOW64\Kmfjodai.dll NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe File opened for modification C:\Windows\SysWOW64\Dhhnpjmh.exe Dmcibama.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5000 4380 WerFault.exe 92 -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dobfld32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dhkjej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll" NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dmcibama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhkjej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dmcibama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll" Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll" Dobfld32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dobfld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll" Dmcibama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll" Dhkjej32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3516 wrote to memory of 4468 3516 NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe 87 PID 3516 wrote to memory of 4468 3516 NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe 87 PID 3516 wrote to memory of 4468 3516 NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe 87 PID 4468 wrote to memory of 3124 4468 Dmcibama.exe 88 PID 4468 wrote to memory of 3124 4468 Dmcibama.exe 88 PID 4468 wrote to memory of 3124 4468 Dmcibama.exe 88 PID 3124 wrote to memory of 2016 3124 Dhhnpjmh.exe 89 PID 3124 wrote to memory of 2016 3124 Dhhnpjmh.exe 89 PID 3124 wrote to memory of 2016 3124 Dhhnpjmh.exe 89 PID 2016 wrote to memory of 4396 2016 Dobfld32.exe 90 PID 2016 wrote to memory of 4396 2016 Dobfld32.exe 90 PID 2016 wrote to memory of 4396 2016 Dobfld32.exe 90 PID 4396 wrote to memory of 3992 4396 Dhkjej32.exe 91 PID 4396 wrote to memory of 3992 4396 Dhkjej32.exe 91 PID 4396 wrote to memory of 3992 4396 Dhkjej32.exe 91 PID 3992 wrote to memory of 4380 3992 Dogogcpo.exe 92 PID 3992 wrote to memory of 4380 3992 Dogogcpo.exe 92 PID 3992 wrote to memory of 4380 3992 Dogogcpo.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f9c003d15298b3c83b9a4b3ae63c34c0.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\Dmcibama.exeC:\Windows\system32\Dmcibama.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\Dhhnpjmh.exeC:\Windows\system32\Dhhnpjmh.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\Dobfld32.exeC:\Windows\system32\Dobfld32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Dhkjej32.exeC:\Windows\system32\Dhkjej32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\Dogogcpo.exeC:\Windows\system32\Dogogcpo.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe7⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 4088⤵
- Program crash
PID:5000
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4380 -ip 43801⤵PID:4896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD560ca312a8810731faa00e35c9e978832
SHA13b9917bc18772ef7619ab29594d26a0154da30df
SHA2563e859fb8b989b2ab8151925123a9a781f8578016428a1d553ded5986c939e778
SHA51259eccd54bcbff84a075a6759bc79d05284c04d3fea2a8c85b2f5808b465a4d0742b0b4ca367260a1bea6b298ab578ac43940b3a1679e1dea8989f67f6a1f2f58
-
Filesize
198KB
MD560ca312a8810731faa00e35c9e978832
SHA13b9917bc18772ef7619ab29594d26a0154da30df
SHA2563e859fb8b989b2ab8151925123a9a781f8578016428a1d553ded5986c939e778
SHA51259eccd54bcbff84a075a6759bc79d05284c04d3fea2a8c85b2f5808b465a4d0742b0b4ca367260a1bea6b298ab578ac43940b3a1679e1dea8989f67f6a1f2f58
-
Filesize
198KB
MD5c79c055e3266492da68a78fe1d1fd25a
SHA1405859a3ca8ec0ad9c163bc1a30f37436622e8d7
SHA2567761d950a94697e95c18d5be725856096abc6d856ba261ffa9a71d623d795cd8
SHA512d2e68a7cb8742e6f5e4df9c57953828b10d88757f42ae6082efc84a2ada0fae7a57ff27b2173fe84165c131ee2ba7639042eb95f7eccd353fbae294f3ea8139b
-
Filesize
198KB
MD5bc0545df100cf49761196157e087533a
SHA17b2807f34f241f61003841b61dc430adea27978e
SHA2569d7f2dc1261f05241fceadf54e6f6bb8912f022f101c066fed1b27aa5251a248
SHA512a362477f06a85d049c3f403e507f12355a09ea8aebc1e857422c271bdc20409fb9f0d879c81bb700ae5bc930aa4d6d688c74b48b25aeb4ed4103cca919ad099c
-
Filesize
198KB
MD5bc0545df100cf49761196157e087533a
SHA17b2807f34f241f61003841b61dc430adea27978e
SHA2569d7f2dc1261f05241fceadf54e6f6bb8912f022f101c066fed1b27aa5251a248
SHA512a362477f06a85d049c3f403e507f12355a09ea8aebc1e857422c271bdc20409fb9f0d879c81bb700ae5bc930aa4d6d688c74b48b25aeb4ed4103cca919ad099c
-
Filesize
198KB
MD53ad39f0c3f548f69cecf431f121afc14
SHA19d4012501c54339897fb0ac50cc843ab85341835
SHA25692026a8d8f0854c6d593204b72900d94343126514f206b7217b8c3d5c1f1c531
SHA5122eb2e6349ba1f943d8e28cfea21f962a04f892c1c6342d8567c3ab4445470c0cd1819ae8c871544c92f47f997beac0e8e019c993cbb09a94049781c2c7c46298
-
Filesize
198KB
MD53ad39f0c3f548f69cecf431f121afc14
SHA19d4012501c54339897fb0ac50cc843ab85341835
SHA25692026a8d8f0854c6d593204b72900d94343126514f206b7217b8c3d5c1f1c531
SHA5122eb2e6349ba1f943d8e28cfea21f962a04f892c1c6342d8567c3ab4445470c0cd1819ae8c871544c92f47f997beac0e8e019c993cbb09a94049781c2c7c46298
-
Filesize
198KB
MD5b1b7627907b8885b34336365d89b4be1
SHA168d4f2d7b3d4cc1a8008d0e50820ab7ff2e5b7f0
SHA256b8ba262674c279e92dddddaef0b9cf2cab41baee451a8315e537266ee7591e2f
SHA512be96e68d44ceb7547a6a76d26e5e0517fd5a1ce87fb970f92fe52c84d9e0f8f3546dafbd215cc8257685efa23e96f2cd263962a9fb4bca4173cbd246dc140837
-
Filesize
198KB
MD5b1b7627907b8885b34336365d89b4be1
SHA168d4f2d7b3d4cc1a8008d0e50820ab7ff2e5b7f0
SHA256b8ba262674c279e92dddddaef0b9cf2cab41baee451a8315e537266ee7591e2f
SHA512be96e68d44ceb7547a6a76d26e5e0517fd5a1ce87fb970f92fe52c84d9e0f8f3546dafbd215cc8257685efa23e96f2cd263962a9fb4bca4173cbd246dc140837
-
Filesize
198KB
MD5c79c055e3266492da68a78fe1d1fd25a
SHA1405859a3ca8ec0ad9c163bc1a30f37436622e8d7
SHA2567761d950a94697e95c18d5be725856096abc6d856ba261ffa9a71d623d795cd8
SHA512d2e68a7cb8742e6f5e4df9c57953828b10d88757f42ae6082efc84a2ada0fae7a57ff27b2173fe84165c131ee2ba7639042eb95f7eccd353fbae294f3ea8139b
-
Filesize
198KB
MD5c79c055e3266492da68a78fe1d1fd25a
SHA1405859a3ca8ec0ad9c163bc1a30f37436622e8d7
SHA2567761d950a94697e95c18d5be725856096abc6d856ba261ffa9a71d623d795cd8
SHA512d2e68a7cb8742e6f5e4df9c57953828b10d88757f42ae6082efc84a2ada0fae7a57ff27b2173fe84165c131ee2ba7639042eb95f7eccd353fbae294f3ea8139b
-
Filesize
198KB
MD54fab8f8fbf4e7fcecf6be41b87b9829b
SHA14b40a16d4314a8448906b4c5a0c975f42bbf6cdd
SHA2569be55fe9057daf8fcf1105a03ce9026101a994e15dce74982724456aebc31a7d
SHA512e3a1c29bad59d7fe2292ca2b6bbded8d6ab9698404adbf8f671771523da3e652d16ae57bc605e689ed9dd5d6a7cf1fa4638331f80208cb2a4e1fa8ad814bac53
-
Filesize
198KB
MD54fab8f8fbf4e7fcecf6be41b87b9829b
SHA14b40a16d4314a8448906b4c5a0c975f42bbf6cdd
SHA2569be55fe9057daf8fcf1105a03ce9026101a994e15dce74982724456aebc31a7d
SHA512e3a1c29bad59d7fe2292ca2b6bbded8d6ab9698404adbf8f671771523da3e652d16ae57bc605e689ed9dd5d6a7cf1fa4638331f80208cb2a4e1fa8ad814bac53
-
Filesize
7KB
MD5a9b679a4026efd40296982c152384765
SHA1ae9e3d936b48a9008dcd4a8551b709d2cb46d3c2
SHA256854f97d8c6a570d82fa939d39e2d52c0726fe8c6327803767f7c61a032902d2b
SHA51294e60d04876b9afd64668b03e61b42de5c6ca023d623b009e84f3928891a1a4b2ce27cccfe34573c60825c39b89a8ff5faac1238ecbde014b70b89c47774b94f