ae09cc5a91f70b12f5a4e6e4ae3ac22a9d4c87e703c1e1bfb542833ff44c2e40

General

Target

NEAS.101f241273033c1e5bfad3f51507b800.exe
Size

3.5MB
MD5

101f241273033c1e5bfad3f51507b800
SHA1

c101b951f2d70ec25d443a20fff8398899744bd7
SHA256

ae09cc5a91f70b12f5a4e6e4ae3ac22a9d4c87e703c1e1bfb542833ff44c2e40
SHA512

0cf2aa4ecbea709f08a85b26e5d1abd36dda42a10efb25170a44deb09de54229353ceba4601a6ad265006fed8fbd511643d6dc22543594a7113d0bdc84e2212c
SSDEEP

49152:rXCY3j+gI4mv+niXtXIMfX2wGBDDQ/XSHdX4MPXGgIMbb:tm4mvHXtWHdDbb

Score

10^/10

Malware Config

Signatures

Malware Backdoor - Berbew 5 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/files/0x00060000000120b7-4.dat	family_berbew
behavioral1/files/0x00060000000120b7-8.dat	family_berbew
behavioral1/files/0x00060000000120b7-10.dat	family_berbew
behavioral1/files/0x00060000000120b7-11.dat	family_berbew
behavioral1/files/0x00060000000120b7-12.dat	family_berbew

Executes dropped EXE 1 IoCs

pid	Process
1428	NEAS.101f241273033c1e5bfad3f51507b800.exe

Loads dropped DLL 4 IoCs

pid	Process
2344	NEAS.101f241273033c1e5bfad3f51507b800.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1428	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2344	NEAS.101f241273033c1e5bfad3f51507b800.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1428	NEAS.101f241273033c1e5bfad3f51507b800.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1428	2344	NEAS.101f241273033c1e5bfad3f51507b800.exe	29
PID 2344 wrote to memory of 1428	2344	NEAS.101f241273033c1e5bfad3f51507b800.exe	29
PID 2344 wrote to memory of 1428	2344	NEAS.101f241273033c1e5bfad3f51507b800.exe	29
PID 2344 wrote to memory of 1428	2344	NEAS.101f241273033c1e5bfad3f51507b800.exe	29
PID 1428 wrote to memory of 1708	1428	NEAS.101f241273033c1e5bfad3f51507b800.exe	30
PID 1428 wrote to memory of 1708	1428	NEAS.101f241273033c1e5bfad3f51507b800.exe	30
PID 1428 wrote to memory of 1708	1428	NEAS.101f241273033c1e5bfad3f51507b800.exe	30
PID 1428 wrote to memory of 1708	1428	NEAS.101f241273033c1e5bfad3f51507b800.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe

Filesize
3.5MB

MD5
b2107243314438cb32bf3336ab8bfa4c

SHA1
ac8fd9f91989e6eb5a44e6efddde74778465813a

SHA256
5ea180deaa8053d891d2f4f58c8bbee7498d5c32ea5c222dcc5e5d84c20665c5

SHA512
0200aa34ef7769ce00764c18e7edcdaf37975604ccab06676b9f1acc716f5344b5910e0244394599b5243ae9e34189a803f1b59ffdc4d933a34abe38089a2e69

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe

Filesize
3.5MB

MD5
b2107243314438cb32bf3336ab8bfa4c

SHA1
ac8fd9f91989e6eb5a44e6efddde74778465813a

SHA256
5ea180deaa8053d891d2f4f58c8bbee7498d5c32ea5c222dcc5e5d84c20665c5

SHA512
0200aa34ef7769ce00764c18e7edcdaf37975604ccab06676b9f1acc716f5344b5910e0244394599b5243ae9e34189a803f1b59ffdc4d933a34abe38089a2e69

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe

Filesize
3.5MB

MD5
b2107243314438cb32bf3336ab8bfa4c

SHA1
ac8fd9f91989e6eb5a44e6efddde74778465813a

SHA256
5ea180deaa8053d891d2f4f58c8bbee7498d5c32ea5c222dcc5e5d84c20665c5

SHA512
0200aa34ef7769ce00764c18e7edcdaf37975604ccab06676b9f1acc716f5344b5910e0244394599b5243ae9e34189a803f1b59ffdc4d933a34abe38089a2e69

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe

Filesize
3.5MB

MD5
b2107243314438cb32bf3336ab8bfa4c

SHA1
ac8fd9f91989e6eb5a44e6efddde74778465813a

SHA256
5ea180deaa8053d891d2f4f58c8bbee7498d5c32ea5c222dcc5e5d84c20665c5

SHA512
0200aa34ef7769ce00764c18e7edcdaf37975604ccab06676b9f1acc716f5344b5910e0244394599b5243ae9e34189a803f1b59ffdc4d933a34abe38089a2e69

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.101f241273033c1e5bfad3f51507b800.exe

Filesize
3.5MB

MD5
b2107243314438cb32bf3336ab8bfa4c

SHA1
ac8fd9f91989e6eb5a44e6efddde74778465813a

SHA256
5ea180deaa8053d891d2f4f58c8bbee7498d5c32ea5c222dcc5e5d84c20665c5

SHA512
0200aa34ef7769ce00764c18e7edcdaf37975604ccab06676b9f1acc716f5344b5910e0244394599b5243ae9e34189a803f1b59ffdc4d933a34abe38089a2e69

Download Submit
memory/1428-9-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2344-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2344-7-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing