a667d7c3905732b5e9218aac29c0b54515f9604ee3af66d41eeb5707ae107eee

Analysis

max time kernel
128s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4804206835f5c055680adb3cd340c5f0.exe
Size

404KB
MD5

4804206835f5c055680adb3cd340c5f0
SHA1

69304a5fad925c0e5f3e8e267e21e1224daf9dba
SHA256

a667d7c3905732b5e9218aac29c0b54515f9604ee3af66d41eeb5707ae107eee
SHA512

81689ab2af704bfde41e2173e842b0cd931281b3fb3bd940058c051f191088075d87feca925c8303218be5c270a88201eb3ca4a315314e271a722a9493ae80e6
SSDEEP

12288:2pcYoJca23XK9zPWkLVobozym34HTFJfpTpSr9Nk+b1k3nxxkPK6yFj/8rfZTpEt:2pcYoJca23XK9zPWkLVobozym34HTFJT

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Malware Backdoor - Berbew 1 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/memory/3416-0-0x0000000000400000-0x000000000046A000-memory.dmp	family_berbew

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3592	3416	WerFault.exe	86
4236	3416	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3592	3416	NEAS.4804206835f5c055680adb3cd340c5f0.exe	91
PID 3416 wrote to memory of 3592	3416	NEAS.4804206835f5c055680adb3cd340c5f0.exe	91
PID 3416 wrote to memory of 3592	3416	NEAS.4804206835f5c055680adb3cd340c5f0.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.4804206835f5c055680adb3cd340c5f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4804206835f5c055680adb3cd340c5f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 188
  2⤵
  - Program crash
  PID:3592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 188
  2⤵
  - Program crash
  PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3416 -ip 3416
1⤵
PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3416-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download