Analysis
-
max time kernel
122s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
05/11/2023, 18:02
Behavioral task
behavioral1
Sample
NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe
-
Size
249KB
-
MD5
902ffaf1351786f248e1468736ac30b0
-
SHA1
eb913b4353964738edc056400caf9045d734dc0a
-
SHA256
010d87e9ec6146dc8c852099fd3b01085312c4ad2e1bd9031b812c547d663562
-
SHA512
727c30fe96db5645c699e46dba3ca0c26ee1ae5bb672bb33273b5f4983d12d2f2733bbea908f97eb213ed32b916c5cb0a00aac8c80d572f4933e81f7728fbda3
-
SSDEEP
6144:8nOsarUet4nM8nvljgd+86ZkjVlFniTqQCSDyigAo7K+2GKO7:8nOfrUeANnvljXjWjTQYNh7K+2G17
Malware Config
Signatures
-
Malware Backdoor - Berbew 2 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x0007000000016c35-12.dat family_berbew behavioral1/files/0x0007000000016c35-13.dat family_berbew -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2304 wrote to memory of 1592 2304 NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe 28 PID 2304 wrote to memory of 1592 2304 NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe 28 PID 2304 wrote to memory of 1592 2304 NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe 28 PID 2304 wrote to memory of 1592 2304 NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe 28 PID 1592 wrote to memory of 2656 1592 cmd.exe 29 PID 1592 wrote to memory of 2656 1592 cmd.exe 29 PID 1592 wrote to memory of 2656 1592 cmd.exe 29 PID 1592 wrote to memory of 2656 1592 cmd.exe 29 PID 2656 wrote to memory of 2900 2656 iexpress.exe 30 PID 2656 wrote to memory of 2900 2656 iexpress.exe 30 PID 2656 wrote to memory of 2900 2656 iexpress.exe 30 PID 2656 wrote to memory of 2900 2656 iexpress.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\AA34.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\NEAS.902ffaf1351786f248e1468736ac30b0_JC.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2900
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
249KB
MD558bd7b5737ace5e6bca2e0d1c35b01d9
SHA169bbf03fa51f4839ac6bcbeddc397ac1a1053e04
SHA2560d846e3e80ac1feb07dde0cac64610258b70d2a4af690777487aabe4600940a4
SHA5126abbee76b88232a7c78bfa03a4adaa179321018d69c25098b05f19a54f7162109a1306775df98323902e70f08e23e6712d368508bd482ad3d4bc438c64cea8a7
-
Filesize
249KB
MD558bd7b5737ace5e6bca2e0d1c35b01d9
SHA169bbf03fa51f4839ac6bcbeddc397ac1a1053e04
SHA2560d846e3e80ac1feb07dde0cac64610258b70d2a4af690777487aabe4600940a4
SHA5126abbee76b88232a7c78bfa03a4adaa179321018d69c25098b05f19a54f7162109a1306775df98323902e70f08e23e6712d368508bd482ad3d4bc438c64cea8a7
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083