a8c62489d943378c07c8847aeb4b7db07244be52b3ec855eb84efbef229a86bf

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b542050f861f44d11be2dadfe6128980.exe
Size

436KB
MD5

b542050f861f44d11be2dadfe6128980
SHA1

81002ff5f0cfcbbc6141373f8078457d202f49c4
SHA256

a8c62489d943378c07c8847aeb4b7db07244be52b3ec855eb84efbef229a86bf
SHA512

0fb9bcaab1de710bae09a1885a06e91b62e376b48c7604d3742282c43daa77cc46946a3fb5fb99f08c71ff3e050e50ce240ab8a77fb01842662134ab2922f146
SSDEEP

12288:kftOFEca6WClS/WFSnV8nI1R+iKfz9cbzmkIE4SXRSRMN:RVhP03nV8nI1R+iKfz9cbzmkIE4SXRSI

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Malware Backdoor - Berbew 1 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/files/0x000b000000022cb3-5.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
4876	NEAS.b542050f861f44d11be2dadfe6128980.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	NEAS.b542050f861f44d11be2dadfe6128980.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4448	3560	WerFault.exe	86
4736	4876	WerFault.exe	94

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3560	NEAS.b542050f861f44d11be2dadfe6128980.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4876	NEAS.b542050f861f44d11be2dadfe6128980.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4876	3560	NEAS.b542050f861f44d11be2dadfe6128980.exe	94
PID 3560 wrote to memory of 4876	3560	NEAS.b542050f861f44d11be2dadfe6128980.exe	94
PID 3560 wrote to memory of 4876	3560	NEAS.b542050f861f44d11be2dadfe6128980.exe	94

C:\Users\Admin\AppData\Local\Temp\NEAS.b542050f861f44d11be2dadfe6128980.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b542050f861f44d11be2dadfe6128980.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 396
  2⤵
  - Program crash
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\NEAS.b542050f861f44d11be2dadfe6128980.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.b542050f861f44d11be2dadfe6128980.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 364
    3⤵
    - Program crash
    PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3560 -ip 3560
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4876 -ip 4876
1⤵
PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.b542050f861f44d11be2dadfe6128980.exe

Filesize
436KB

MD5
94d663f23530bbb4846a9aac75319a51

SHA1
f5313bff0bc144e52886606ad569ee98be74b77d

SHA256
d1bb75a497e9e3f12c267afae1b1d04a38d3653b7839e397029e4ee34787b516

SHA512
817fc55623d019fd29a0da0af61bca11045841440f13b783b9a1c09fc506d1e68de9f549e3ab8bc66dec8105867f6a25815a936be7c552232d5cb101c2f1cef8

Download Submit
memory/3560-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3560-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4876-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4876-9-0x0000000000140000-0x0000000000178000-memory.dmp

Filesize
224KB

Download
memory/4876-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4876-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download