fb8b651af84393dd19007b0244d96eb41a474dfff40655870ae1daf007d1252f

General

Target

NEAS.0a7cdbe5da4512897ab06326fe40c070.exe
Size

3.6MB
MD5

0a7cdbe5da4512897ab06326fe40c070
SHA1

0ab06aa65e2d35b217c06ed3e8b3836ed21b20be
SHA256

fb8b651af84393dd19007b0244d96eb41a474dfff40655870ae1daf007d1252f
SHA512

aa67988c350c7105952d852dcbbc4670ad26ca4511f415924127c35666ce78036a4aa012562bb3910338fed16202874e1bd0dc7e514c8f30a20e247b26a8bd7c
SSDEEP

98304:7g9NBc/8gZshK4n86WrWD3Zshyxvhvl9verYaFE21j1KKLdzgUrphB4bISo+n:8nBK8gb4nZp3Txvhvl9verYaFE21j1K7

Score

10^/10

Malware Config

Signatures

Malware Backdoor - Berbew 2 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/files/0x00070000000120ca-4.dat	family_berbew
behavioral1/files/0x00070000000120ca-9.dat	family_berbew

Executes dropped EXE 1 IoCs

pid	Process
2008	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Loads dropped DLL 1 IoCs

pid	Process
1140	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1140	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2008	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2008	1140	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe	29
PID 1140 wrote to memory of 2008	1140	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe	29
PID 1140 wrote to memory of 2008	1140	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe	29
PID 1140 wrote to memory of 2008	1140	NEAS.0a7cdbe5da4512897ab06326fe40c070.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.0a7cdbe5da4512897ab06326fe40c070.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0a7cdbe5da4512897ab06326fe40c070.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\NEAS.0a7cdbe5da4512897ab06326fe40c070.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.0a7cdbe5da4512897ab06326fe40c070.exe
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA20B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Filesize
3.6MB

MD5
fe1bb5fe043d51e2cc7293ddebc0d480

SHA1
652976de9a170052a91272df9bc7d258dfb0e08e

SHA256
15ac760e6940d31f55d820ac64440d83bfae5eaade5625a7eec58ab8b85bb388

SHA512
1d524d7b0eee3b9ef199aa16c804b27470fe26ed678d8fd31137001ab9ada654a0adbc59306979e976112f9c8ca91c7e07e11a977f575d06d0b83f4dbcc32719

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA28B.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.0a7cdbe5da4512897ab06326fe40c070.exe

Filesize
3.6MB

MD5
fe1bb5fe043d51e2cc7293ddebc0d480

SHA1
652976de9a170052a91272df9bc7d258dfb0e08e

SHA256
15ac760e6940d31f55d820ac64440d83bfae5eaade5625a7eec58ab8b85bb388

SHA512
1d524d7b0eee3b9ef199aa16c804b27470fe26ed678d8fd31137001ab9ada654a0adbc59306979e976112f9c8ca91c7e07e11a977f575d06d0b83f4dbcc32719

Download Submit
memory/1140-0-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/1140-6-0x0000000001510000-0x000000000161E000-memory.dmp

Filesize
1.1MB

Download
memory/1140-8-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2008-10-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2008-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2008-12-0x0000000002E60000-0x0000000002F6E000-memory.dmp

Filesize
1.1MB

Download
memory/2008-65-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2008-68-0x000000000EFE0000-0x000000000F083000-memory.dmp

Filesize
652KB

Download

Analysis

Sharing