Analysis
-
max time kernel
138s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
11/11/2023, 06:02
General
-
Target
NEAS.03c9baf8c968d7f40eec298c11104550.exe
-
Size
3.2MB
-
MD5
03c9baf8c968d7f40eec298c11104550
-
SHA1
7a8b0f54d74ac753f5eb9f35efe6be979ce06463
-
SHA256
bd61cc960e2ccbaf3e7b814bcb4d492b23459931df20fd90a93ef6296ae6445a
-
SHA512
1b3344265bb965effa7445f940aecfc55307ad7561e154a7dd4d42ff35db446a655b794b97d0caa796a5e051ef8d0c39e7afdc30e59b575d227fe3f4d08faf2e
-
SSDEEP
98304:xjalBFLPj3JStuv40ar7zrbDlsa2VIlPWYv1NT/YUugy:YlBFLPj3JStuv40ar7zrbDlsa2VIlPWH
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 28 IoCs
-
Malware Backdoor - Berbew 32 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
-
Executes dropped EXE 14 IoCs
-
Drops file in System32 directory 42 IoCs
-
Program crash 1 IoCs
-
Modifies registry class 45 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.03c9baf8c968d7f40eec298c11104550.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.03c9baf8c968d7f40eec298c11104550.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Oqhoeb32.exeC:\Windows\system32\Oqhoeb32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ocihgnam.exeC:\Windows\system32\Ocihgnam.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ockdmmoj.exeC:\Windows\system32\Ockdmmoj.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ocnabm32.exeC:\Windows\system32\Ocnabm32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pjjfdfbb.exeC:\Windows\system32\Pjjfdfbb.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pafkgphl.exeC:\Windows\system32\Pafkgphl.exe7⤵
-
C:\Windows\SysWOW64\Pplhhm32.exeC:\Windows\system32\Pplhhm32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pciqnk32.exeC:\Windows\system32\Pciqnk32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Qbonoghb.exeC:\Windows\system32\Qbonoghb.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bpedeiff.exeC:\Windows\system32\Bpedeiff.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bmladm32.exeC:\Windows\system32\Bmladm32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cmnnimak.exeC:\Windows\system32\Cmnnimak.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ckggnp32.exeC:\Windows\system32\Ckggnp32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Diqnjl32.exeC:\Windows\system32\Diqnjl32.exe15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 42016⤵
- Program crash
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 11881⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5ab1599457231a68b9623ab31c3433218
SHA1cb94a3ec181009d127860943fd793f974d93989b
SHA256c0821e555a341b42634593279b00723c44821b243dd32802026ee7749795df1b
SHA512770fe003680269c63f66c072db1d3a2e0082d96bbb4660bdaea390229fb1403956866f264ba678fc40e691128307a4276fc1d9129ae1029804899f60e6389dfd
-
Filesize
3.2MB
MD5bea940a240f6b28aa8870090d1d77ef8
SHA17f701ac79f3da66360063415471cb920b3f82a52
SHA25668a1b7faed640334cbb5ec8cad6410ad34e4147117bcc3d1039fd668b12a4d6f
SHA5124e75b0dc089243262aade13c14922effafa926b0df7589b77e08dcd2ccbd58783c33791c1c7cb4b384dcc7330e9f6bf0253ee89630309f684fde03162595acb4
-
Filesize
3.2MB
MD5bea940a240f6b28aa8870090d1d77ef8
SHA17f701ac79f3da66360063415471cb920b3f82a52
SHA25668a1b7faed640334cbb5ec8cad6410ad34e4147117bcc3d1039fd668b12a4d6f
SHA5124e75b0dc089243262aade13c14922effafa926b0df7589b77e08dcd2ccbd58783c33791c1c7cb4b384dcc7330e9f6bf0253ee89630309f684fde03162595acb4
-
Filesize
3.2MB
MD5bf65e5ff264ba61c758e5c6940c035f2
SHA15fb32e0fd6e600d4118aec60b8e5b890ade9ddb9
SHA2568b509fba36b680f5d230411a123b1bc05a7d1ee9daaf51c431a91d4544326f42
SHA512a7a1ee9e2422e3872a5ffbcb52c9979d16d41bb760723e1ccb95c600d7ddef7ac03c6ba8647aa66362ee0a3fa06e132c69e0755970f6bdc7aa1dac68d94400d4
-
Filesize
3.2MB
MD5bf65e5ff264ba61c758e5c6940c035f2
SHA15fb32e0fd6e600d4118aec60b8e5b890ade9ddb9
SHA2568b509fba36b680f5d230411a123b1bc05a7d1ee9daaf51c431a91d4544326f42
SHA512a7a1ee9e2422e3872a5ffbcb52c9979d16d41bb760723e1ccb95c600d7ddef7ac03c6ba8647aa66362ee0a3fa06e132c69e0755970f6bdc7aa1dac68d94400d4
-
Filesize
3.2MB
MD53a4d5b001cdfbf68988b6d826efbc287
SHA1dec3c20bdc988fa3cff46b915654199e5b287602
SHA25636ce3a42ec0c5a73a506325750956c73bf510c6df40da8a83eabb4a68280af2f
SHA512f7dbda62da1aa1aa7945a42193583947566513f5ca445adeee350bc20ac23c714a8125f7c0e4f3b900af73719eaa89f5e14a34eb5027250bab5b32a2c2b63686
-
Filesize
3.2MB
MD53a4d5b001cdfbf68988b6d826efbc287
SHA1dec3c20bdc988fa3cff46b915654199e5b287602
SHA25636ce3a42ec0c5a73a506325750956c73bf510c6df40da8a83eabb4a68280af2f
SHA512f7dbda62da1aa1aa7945a42193583947566513f5ca445adeee350bc20ac23c714a8125f7c0e4f3b900af73719eaa89f5e14a34eb5027250bab5b32a2c2b63686
-
Filesize
3.2MB
MD5ecd6941e4a305c91bea538828fa145a2
SHA166532a5deed841d4d847c33cf8257405f29e9a07
SHA256f36654a5278bac946abf8dc25542113e723558684280fd3afcc8827d640ef00b
SHA512bec1f392d6a3c35ed96b1f5c02e62c138396110367abb6265c8ec98e068ad8ba914f87791884c5858bbcd2aa2c4fcf55317b37a9e27a3b53722d749ab7c48474
-
Filesize
3.2MB
MD5ecd6941e4a305c91bea538828fa145a2
SHA166532a5deed841d4d847c33cf8257405f29e9a07
SHA256f36654a5278bac946abf8dc25542113e723558684280fd3afcc8827d640ef00b
SHA512bec1f392d6a3c35ed96b1f5c02e62c138396110367abb6265c8ec98e068ad8ba914f87791884c5858bbcd2aa2c4fcf55317b37a9e27a3b53722d749ab7c48474
-
Filesize
3.2MB
MD5ecd6941e4a305c91bea538828fa145a2
SHA166532a5deed841d4d847c33cf8257405f29e9a07
SHA256f36654a5278bac946abf8dc25542113e723558684280fd3afcc8827d640ef00b
SHA512bec1f392d6a3c35ed96b1f5c02e62c138396110367abb6265c8ec98e068ad8ba914f87791884c5858bbcd2aa2c4fcf55317b37a9e27a3b53722d749ab7c48474
-
Filesize
3.2MB
MD55a3fb341ef6092fcadcad5c81d00fd6d
SHA15c3e939bc68c829fe91e5f39ebe644f777d33a15
SHA256faf37a33e9151189d1080f8de610235c1b8759ddfefd62e6c9f1f75c1aa76a51
SHA51292f68ec6889f3298f691baf9f7b7627088edf41b54cb547ce0aec33924c46e0f5e1694c50a606593775813d78c04269bbb53708877840a3ccdfccb194908d4a6
-
Filesize
3.2MB
MD55a3fb341ef6092fcadcad5c81d00fd6d
SHA15c3e939bc68c829fe91e5f39ebe644f777d33a15
SHA256faf37a33e9151189d1080f8de610235c1b8759ddfefd62e6c9f1f75c1aa76a51
SHA51292f68ec6889f3298f691baf9f7b7627088edf41b54cb547ce0aec33924c46e0f5e1694c50a606593775813d78c04269bbb53708877840a3ccdfccb194908d4a6
-
Filesize
7KB
MD50dfc5d31a29ac3b9dc3b0ea44d92401e
SHA13c38d8ca62e02df3515a6ab55bfa55102f81d8ad
SHA2564c0a84c1a46bf35a14ba236c03c8883b9859179e446f594ca01925f19d84a535
SHA5122047497619758b3107111c60a7a10fa215574820165427d39e9dde1974665d2b045cb77904c040caeacb1e23af5606fb3a71d45db563f7904b0dde109fdd81c6
-
Filesize
3.2MB
MD58edc85e6a2b24dea934bd06a598da625
SHA1d8d861fa4becc0fcd2964baf96f6b0c050acdebe
SHA256915c65471d08ac83d3b4835555d63bddb1ecc9856f53f643e7a2769faaad4504
SHA512150af50b27dd465d4d6c3e53dd2fb2c2adaa97a787ed2c195a421dbf38888bf9e169f177010bfde19b6a29dbac47e392f080526e9ec1498aab8588e0b20b73bb
-
Filesize
3.2MB
MD58edc85e6a2b24dea934bd06a598da625
SHA1d8d861fa4becc0fcd2964baf96f6b0c050acdebe
SHA256915c65471d08ac83d3b4835555d63bddb1ecc9856f53f643e7a2769faaad4504
SHA512150af50b27dd465d4d6c3e53dd2fb2c2adaa97a787ed2c195a421dbf38888bf9e169f177010bfde19b6a29dbac47e392f080526e9ec1498aab8588e0b20b73bb
-
Filesize
3.2MB
MD544d33041e2d1af61d40bbff8d456f109
SHA1a7db3e9c983e76aa8c657f9a6e1296822084813e
SHA256321266d76cac64c0de4d00bd9d102d7e713ea12e5efe014cda7259b4a40b9fce
SHA512ded4dbcae268992a0e84160d4c6c8ab688df8dd73d31f10953a4878fcfdbf7d979775519d5cbeed5cd20a74822faef0682bf7c4676352405a7e3adcddd4ee567
-
Filesize
3.2MB
MD544d33041e2d1af61d40bbff8d456f109
SHA1a7db3e9c983e76aa8c657f9a6e1296822084813e
SHA256321266d76cac64c0de4d00bd9d102d7e713ea12e5efe014cda7259b4a40b9fce
SHA512ded4dbcae268992a0e84160d4c6c8ab688df8dd73d31f10953a4878fcfdbf7d979775519d5cbeed5cd20a74822faef0682bf7c4676352405a7e3adcddd4ee567
-
Filesize
3.2MB
MD544d33041e2d1af61d40bbff8d456f109
SHA1a7db3e9c983e76aa8c657f9a6e1296822084813e
SHA256321266d76cac64c0de4d00bd9d102d7e713ea12e5efe014cda7259b4a40b9fce
SHA512ded4dbcae268992a0e84160d4c6c8ab688df8dd73d31f10953a4878fcfdbf7d979775519d5cbeed5cd20a74822faef0682bf7c4676352405a7e3adcddd4ee567
-
Filesize
3.2MB
MD5ee6a6562e98f53cf5929afb3a86deb75
SHA15f0781eb2049fcd63c0db6d88fffb59bdc5cd7ab
SHA25634d16ce2041f082e21e972e89946132f868c842159090113b8a75143fc897c80
SHA5123881b6711c8c4bd666841a246a1a63af812daecbcbf19da91f77a2b8455994fe3b7fbb77c0f93e29d22cc3f6f749d4ce7ce8ff29984897876f72069ac18c90ad
-
Filesize
3.2MB
MD5ee6a6562e98f53cf5929afb3a86deb75
SHA15f0781eb2049fcd63c0db6d88fffb59bdc5cd7ab
SHA25634d16ce2041f082e21e972e89946132f868c842159090113b8a75143fc897c80
SHA5123881b6711c8c4bd666841a246a1a63af812daecbcbf19da91f77a2b8455994fe3b7fbb77c0f93e29d22cc3f6f749d4ce7ce8ff29984897876f72069ac18c90ad
-
Filesize
3.2MB
MD5479b50bfe3908134f7bfa6d19c0105ef
SHA11d37e2bba293f9e353f667e70634763c678cbc38
SHA2560eb65e87bf4e44a9531d90d21838bc5b31a906544e08cfcf3ef9bd4b9134170e
SHA51255acd21dd0e0dde6cb0b20fe9688782c88062b16875ccfe475f6be4be7ed2f87b44b62ce8679dfda98c65c4b748488e5d3951f9ee8f8d9ee78da42f5a6872cb2
-
Filesize
3.2MB
MD5479b50bfe3908134f7bfa6d19c0105ef
SHA11d37e2bba293f9e353f667e70634763c678cbc38
SHA2560eb65e87bf4e44a9531d90d21838bc5b31a906544e08cfcf3ef9bd4b9134170e
SHA51255acd21dd0e0dde6cb0b20fe9688782c88062b16875ccfe475f6be4be7ed2f87b44b62ce8679dfda98c65c4b748488e5d3951f9ee8f8d9ee78da42f5a6872cb2
-
Filesize
3.2MB
MD57bdac340d3e50b87becb5a85ab6dd510
SHA1493eb623d23f08952a89255d540fb532e2b90b53
SHA25695d749fc73672085c5fbb6d863d7bdb8ad4348afef721dc5780e091097a77ada
SHA512b17423415518e3dd3341ed3d1be5c609695e99f5cb4f7b514cfacbd0771c348bb230321f77aab7c2f873524176f1014e1e8ddef2b101ba6b6bd017fdd8dcba3c
-
Filesize
3.2MB
MD57bdac340d3e50b87becb5a85ab6dd510
SHA1493eb623d23f08952a89255d540fb532e2b90b53
SHA25695d749fc73672085c5fbb6d863d7bdb8ad4348afef721dc5780e091097a77ada
SHA512b17423415518e3dd3341ed3d1be5c609695e99f5cb4f7b514cfacbd0771c348bb230321f77aab7c2f873524176f1014e1e8ddef2b101ba6b6bd017fdd8dcba3c
-
Filesize
3.2MB
MD500788b1b772f825bd5afac8e9c890afe
SHA11fdf14fb4eff587044f82345dc627e9d0c282ecb
SHA256437d05d4d6d28cff7e8d78d9ed4bf4786b97fea21caac00102ba9ebe84e8921d
SHA5124baa10377ad5e06751f12ab8bd3dbc334ad99bc5cc9f07bc43d991916d12c40d9143b6cda178b6d9a7dc9cc40ff80ed465b672a1e24bc8d2bba77e8e36265fe4
-
Filesize
3.2MB
MD500788b1b772f825bd5afac8e9c890afe
SHA11fdf14fb4eff587044f82345dc627e9d0c282ecb
SHA256437d05d4d6d28cff7e8d78d9ed4bf4786b97fea21caac00102ba9ebe84e8921d
SHA5124baa10377ad5e06751f12ab8bd3dbc334ad99bc5cc9f07bc43d991916d12c40d9143b6cda178b6d9a7dc9cc40ff80ed465b672a1e24bc8d2bba77e8e36265fe4
-
Filesize
3.2MB
MD5aee81c7407998448b288f1a59d4bc966
SHA1d4877c607937b47ffd0b06f11072465351e7c4d6
SHA256130e21ed2a8a603ee0c626f7112178fbfdaaf32b2ce3ec006e776956ed7bea80
SHA512c3ba47e95c5d9df6706134dff6f4cbd3a5db19bbfe333d84a4d6dfee77415e90ba8eb76b7d08b88a7b3bb2d2e7cccd5c10fb084bfa9b875fc0841f19f4542d63
-
Filesize
3.2MB
MD5aee81c7407998448b288f1a59d4bc966
SHA1d4877c607937b47ffd0b06f11072465351e7c4d6
SHA256130e21ed2a8a603ee0c626f7112178fbfdaaf32b2ce3ec006e776956ed7bea80
SHA512c3ba47e95c5d9df6706134dff6f4cbd3a5db19bbfe333d84a4d6dfee77415e90ba8eb76b7d08b88a7b3bb2d2e7cccd5c10fb084bfa9b875fc0841f19f4542d63
-
Filesize
3.2MB
MD5fe89a5c7c722c9713a3323a1e78821bf
SHA1c38e0751a8914fbe6c8b343a9ca1b6a92a589066
SHA2568345e5d327dbc0cf85e89ce9550f7def494e5fe3276768cecc40917c03136c38
SHA51261526490af3be76e964988276c7a398a7e1ab4b480c0d3276993de6fd1e98e9f1d5804dfe80b5d25b33ae48916c4e33c98653ab8d790a2bc30d3172c9386609b
-
Filesize
3.2MB
MD5fe89a5c7c722c9713a3323a1e78821bf
SHA1c38e0751a8914fbe6c8b343a9ca1b6a92a589066
SHA2568345e5d327dbc0cf85e89ce9550f7def494e5fe3276768cecc40917c03136c38
SHA51261526490af3be76e964988276c7a398a7e1ab4b480c0d3276993de6fd1e98e9f1d5804dfe80b5d25b33ae48916c4e33c98653ab8d790a2bc30d3172c9386609b
-
Filesize
3.2MB
MD523e8fe015c22dcffc4bc99c8d6829eff
SHA10028e385a195af844c4c5f061b16be4ed32c7491
SHA2569893d869a36f5af158ebade973b240ef30fa469307a461e024fc948731c80e3a
SHA51299b1e43365aec45e2127fc8ec995a4d693ff9d6680c799422b55750b2a40a43f43e338a079d4a6721659ba8e48a14e9055574a3a137ca25b4bc2541873186bca
-
Filesize
3.2MB
MD523e8fe015c22dcffc4bc99c8d6829eff
SHA10028e385a195af844c4c5f061b16be4ed32c7491
SHA2569893d869a36f5af158ebade973b240ef30fa469307a461e024fc948731c80e3a
SHA51299b1e43365aec45e2127fc8ec995a4d693ff9d6680c799422b55750b2a40a43f43e338a079d4a6721659ba8e48a14e9055574a3a137ca25b4bc2541873186bca
-
Filesize
3.2MB
MD523e8fe015c22dcffc4bc99c8d6829eff
SHA10028e385a195af844c4c5f061b16be4ed32c7491
SHA2569893d869a36f5af158ebade973b240ef30fa469307a461e024fc948731c80e3a
SHA51299b1e43365aec45e2127fc8ec995a4d693ff9d6680c799422b55750b2a40a43f43e338a079d4a6721659ba8e48a14e9055574a3a137ca25b4bc2541873186bca
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB