a2fb1c258832c11f50f6e9e55b40669f34163e837cf71508bee3277e6ff9c2ce

General

Target

NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
Size

697KB
MD5

fb62540317c6aa4d1d19c2b5fa805d80
SHA1

dc883134ad62b128e7c123c9cfdd958df7ed9bff
SHA256

a2fb1c258832c11f50f6e9e55b40669f34163e837cf71508bee3277e6ff9c2ce
SHA512

d45c37d94cf98ed9b3e2da9f8b3b809c7c222799cf0b979d5dadb56bcf8d08d64f76209917383a9f80912f06a67c19676b5e1ce0fbad5b067ae244db99c9f21a
SSDEEP

12288:lSa8nrEz1MSHMUJpTZ2KLP+/SRERnnwNqQ8dGx//DuVTkw1gMyfiEl:lwnrAW+MUJV1j+/S2RnUR8dGx//DuVTY

Score

10^/10

Malware Config

Signatures

Malware Backdoor - Berbew 2 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/files/0x00060000000120b7-10.dat	family_berbew
behavioral1/files/0x00060000000120b7-15.dat	family_berbew

Deletes itself 1 IoCs

pid	Process
1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Executes dropped EXE 1 IoCs

pid	Process
1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Loads dropped DLL 1 IoCs

pid	Process
2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2656	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1200	2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	28
PID 2344 wrote to memory of 1200	2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	28
PID 2344 wrote to memory of 1200	2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	28
PID 2344 wrote to memory of 1200	2344	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	28
PID 1200 wrote to memory of 2656	1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	29
PID 1200 wrote to memory of 2656	1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	29
PID 1200 wrote to memory of 2656	1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	29
PID 1200 wrote to memory of 2656	1200	NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA6AD.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Filesize
697KB

MD5
6ca1044c10d1997d7cbb3afd96b1a41b

SHA1
d6e55cf92227f66951ed4b4e18322e59ded8f99d

SHA256
a549cad3e77c571a75e42931ff6903c1bd23282b42bd762f9039fd58271ef9e1

SHA512
693f1c34e1c220ed2e48ee8e1c86d91580459a9104d8a14fb1a501c5611917b2425ed44243402970491e3ef4e872adc306a110e0c82c5a09321a50189851eb12

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA75C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.fb62540317c6aa4d1d19c2b5fa805d80.exe

Filesize
697KB

MD5
6ca1044c10d1997d7cbb3afd96b1a41b

SHA1
d6e55cf92227f66951ed4b4e18322e59ded8f99d

SHA256
a549cad3e77c571a75e42931ff6903c1bd23282b42bd762f9039fd58271ef9e1

SHA512
693f1c34e1c220ed2e48ee8e1c86d91580459a9104d8a14fb1a501c5611917b2425ed44243402970491e3ef4e872adc306a110e0c82c5a09321a50189851eb12

Download Submit
memory/1200-16-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1200-18-0x00000000001A0000-0x0000000000225000-memory.dmp

Filesize
532KB

Download
memory/1200-24-0x0000000002D10000-0x0000000002D8E000-memory.dmp

Filesize
504KB

Download
memory/1200-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1200-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2344-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2344-0-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2344-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2344-2-0x0000000001490000-0x0000000001515000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads