2fbb770fa3c792375c1db152fbedf0bcb0e8db645411db63c23e55c9f97584b3

General

Target

NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe
Size

1.4MB
MD5

6b820b018cbfadbbe6162a588f5e3c10
SHA1

f34a183737326ca62ff62a586fe9b52a2d3f60e1
SHA256

2fbb770fa3c792375c1db152fbedf0bcb0e8db645411db63c23e55c9f97584b3
SHA512

97f32d7e1ead571c2514f66bb4a3b81f312a57b1a9738db728189359a87927980a36f28e136431102faa4410f8597fc2828945a6415dec50a20be8ab2fe91bdc
SSDEEP

12288:PKxcEeha5sAIfMiBHjVDa/ZSF1q26JHnhvMCtjW:PKc9h2n4Fa/ZSF1q26NueC

Score

10^/10

Malware Config

Signatures

Malware Backdoor - Berbew 9 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/memory/2828-0-0x0000000000400000-0x00000000004F2000-memory.dmp	family_berbew
behavioral1/files/0x0009000000012027-4.dat	family_berbew
behavioral1/memory/2828-7-0x0000000000400000-0x00000000004F2000-memory.dmp	family_berbew
behavioral1/memory/1712-9-0x0000000000400000-0x00000000004F2000-memory.dmp	family_berbew
behavioral1/files/0x0009000000012027-8.dat	family_berbew
behavioral1/memory/1712-10-0x0000000002F10000-0x0000000003002000-memory.dmp	family_berbew
behavioral1/files/0x0009000000012027-12.dat	family_berbew
behavioral1/files/0x0009000000012027-11.dat	family_berbew
behavioral1/files/0x0009000000012027-13.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Executes dropped EXE 1 IoCs

pid	Process
1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Loads dropped DLL 4 IoCs

pid	Process
2828	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1712	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2828	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1712	2828	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	29
PID 2828 wrote to memory of 1712	2828	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	29
PID 2828 wrote to memory of 1712	2828	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	29
PID 2828 wrote to memory of 1712	2828	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	29
PID 1712 wrote to memory of 1752	1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	30
PID 1712 wrote to memory of 1752	1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	30
PID 1712 wrote to memory of 1752	1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	30
PID 1712 wrote to memory of 1752	1712	NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Filesize
1.4MB

MD5
665d5795de700d99ae52edd4c5a7be91

SHA1
b8bf0c1f618076543dc28becdefd05ba7b191a27

SHA256
f790d3ba3377e5c62772e48a8cd164ab8c434b1ff384922e01a38f56fe2ac6c9

SHA512
457687050f86b9d4b0722b72e8ea717be262a233381e38adfe4bc6e2d9c5c150b0e90a7fc4aef3927c9fd9de2873a6531257835c512693a89e02133634237b4b

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Filesize
1.4MB

MD5
665d5795de700d99ae52edd4c5a7be91

SHA1
b8bf0c1f618076543dc28becdefd05ba7b191a27

SHA256
f790d3ba3377e5c62772e48a8cd164ab8c434b1ff384922e01a38f56fe2ac6c9

SHA512
457687050f86b9d4b0722b72e8ea717be262a233381e38adfe4bc6e2d9c5c150b0e90a7fc4aef3927c9fd9de2873a6531257835c512693a89e02133634237b4b

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Filesize
1.4MB

MD5
665d5795de700d99ae52edd4c5a7be91

SHA1
b8bf0c1f618076543dc28becdefd05ba7b191a27

SHA256
f790d3ba3377e5c62772e48a8cd164ab8c434b1ff384922e01a38f56fe2ac6c9

SHA512
457687050f86b9d4b0722b72e8ea717be262a233381e38adfe4bc6e2d9c5c150b0e90a7fc4aef3927c9fd9de2873a6531257835c512693a89e02133634237b4b

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Filesize
1.4MB

MD5
665d5795de700d99ae52edd4c5a7be91

SHA1
b8bf0c1f618076543dc28becdefd05ba7b191a27

SHA256
f790d3ba3377e5c62772e48a8cd164ab8c434b1ff384922e01a38f56fe2ac6c9

SHA512
457687050f86b9d4b0722b72e8ea717be262a233381e38adfe4bc6e2d9c5c150b0e90a7fc4aef3927c9fd9de2873a6531257835c512693a89e02133634237b4b

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.6b820b018cbfadbbe6162a588f5e3c10.exe

Filesize
1.4MB

MD5
665d5795de700d99ae52edd4c5a7be91

SHA1
b8bf0c1f618076543dc28becdefd05ba7b191a27

SHA256
f790d3ba3377e5c62772e48a8cd164ab8c434b1ff384922e01a38f56fe2ac6c9

SHA512
457687050f86b9d4b0722b72e8ea717be262a233381e38adfe4bc6e2d9c5c150b0e90a7fc4aef3927c9fd9de2873a6531257835c512693a89e02133634237b4b

Download Submit
memory/1712-9-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1712-10-0x0000000002F10000-0x0000000003002000-memory.dmp

Filesize
968KB

Download
memory/1712-14-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2828-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2828-7-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing