d4c265c05c7ba4edb94c5f838cc9b046eaaa21c1bf2527e492290d8a466049e8

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.07202bce0fea3db0897f88992f8f2620_JC.exe
Size

1024KB
MD5

07202bce0fea3db0897f88992f8f2620
SHA1

83c3313d2f9802e9c23babc4b6e40f656eb4dfb6
SHA256

d4c265c05c7ba4edb94c5f838cc9b046eaaa21c1bf2527e492290d8a466049e8
SHA512

e41707394f545929fa8321ea1c61525d60568118fe7c39ff391af859f398e9087557f67a45c9afad4fab999412202a908f3d27ca42c1887b255d0bbfa033e846
SSDEEP

24576:Tax5QWMM0WdczyxWZQdsk5ueMLZmN1DUZmSordfq6H:Tax5+M0WqzyEQdVOZmXYZmSadfq+

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Malware Backdoor - Berbew 2 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/files/0x0006000000022ccb-2.dat	family_berbew
behavioral2/files/0x0006000000022ccb-3.dat	family_berbew

Executes dropped EXE 1 IoCs

pid	Process
780	1085.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 780	1460	NEAS.07202bce0fea3db0897f88992f8f2620_JC.exe	91
PID 1460 wrote to memory of 780	1460	NEAS.07202bce0fea3db0897f88992f8f2620_JC.exe	91
PID 1460 wrote to memory of 780	1460	NEAS.07202bce0fea3db0897f88992f8f2620_JC.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.07202bce0fea3db0897f88992f8f2620_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.07202bce0fea3db0897f88992f8f2620_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\1085.tmp
  "C:\Users\Admin\AppData\Local\Temp\1085.tmp"
  2⤵
  - Executes dropped EXE
  PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1085.tmp

Filesize
1024KB

MD5
97a033e55e4f6ee20bc877639a183ea9

SHA1
220a3aff973717eb553ef7c97d12e4ddfc3e8bb4

SHA256
14dc0b603630e3ef1dc9fc7c47cfa8ad40940cc18b903d9a5c933fbaa759e7ac

SHA512
3c6b49575ac7e5b6207127b2bb3874afdf1c0284c777c969f71081c0151819479874d2893b9880bca2d2d4ccf563981f92d3cfff2dabae054a3f528f74424156

Download Submit
C:\Users\Admin\AppData\Local\Temp\1085.tmp

Filesize
1024KB

MD5
97a033e55e4f6ee20bc877639a183ea9

SHA1
220a3aff973717eb553ef7c97d12e4ddfc3e8bb4

SHA256
14dc0b603630e3ef1dc9fc7c47cfa8ad40940cc18b903d9a5c933fbaa759e7ac

SHA512
3c6b49575ac7e5b6207127b2bb3874afdf1c0284c777c969f71081c0151819479874d2893b9880bca2d2d4ccf563981f92d3cfff2dabae054a3f528f74424156

Download Submit