3d3a22a846413a1abd25d0304dbe63734f817ede5e2f5a6b055941dd0c518619

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe
Size

203KB
MD5

db6e1ea8d3838342c0250e4fb6dd8890
SHA1

2f7d1558049692299e2f1c0ca6bdd4773a68fb31
SHA256

3d3a22a846413a1abd25d0304dbe63734f817ede5e2f5a6b055941dd0c518619
SHA512

195d23db6720fb031eed68b87d6085247ef21625769d5f5881992037dfa04629b0e4b98dbd695f9bb898f95f931361b8b4d7293d12724586fea7bbc2935fc8dd
SSDEEP

6144:gZqmrnoSEW+pEkyMeQxqqF4jiZaCXojcKredsIgWsZ:gFoSEZLeQXg

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Malware Backdoor - Berbew 7 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/memory/844-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_berbew
behavioral1/files/0x000700000001210a-4.dat	family_berbew
behavioral1/memory/844-6-0x0000000000310000-0x000000000034E000-memory.dmp	family_berbew
behavioral1/memory/844-10-0x0000000000400000-0x000000000043E000-memory.dmp	family_berbew
behavioral1/files/0x000700000001210a-9.dat	family_berbew
behavioral1/memory/2728-11-0x0000000000400000-0x000000000043E000-memory.dmp	family_berbew
behavioral1/memory/2728-15-0x00000000002F0000-0x000000000032E000-memory.dmp	family_berbew

Deletes itself 1 IoCs

pid	Process
2728	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Loads dropped DLL 1 IoCs

pid	Process
844	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
844	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2728	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2728	844	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe	28
PID 844 wrote to memory of 2728	844	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe	28
PID 844 wrote to memory of 2728	844	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe	28
PID 844 wrote to memory of 2728	844	NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Filesize
203KB

MD5
94cfc2c423592149637e78cc943bfaaf

SHA1
cafeb2ed95c99bffd44c83f69587c685e7c8a711

SHA256
ee31010edc57352b0e0de595256c986d944d017906328a43e710b7107f2af901

SHA512
930e8b29e456dfa8ba183103be571e37c4000c505a2a54de0ac3d4891c2a7d04c602c917ef968dd4bf4104f22665e9a85ba56f86311644fa6a775c154ba12512

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.db6e1ea8d3838342c0250e4fb6dd8890.exe

Filesize
203KB

MD5
94cfc2c423592149637e78cc943bfaaf

SHA1
cafeb2ed95c99bffd44c83f69587c685e7c8a711

SHA256
ee31010edc57352b0e0de595256c986d944d017906328a43e710b7107f2af901

SHA512
930e8b29e456dfa8ba183103be571e37c4000c505a2a54de0ac3d4891c2a7d04c602c917ef968dd4bf4104f22665e9a85ba56f86311644fa6a775c154ba12512

Download Submit
memory/844-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/844-6-0x0000000000310000-0x000000000034E000-memory.dmp

Filesize
248KB

Download
memory/844-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2728-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2728-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2728-15-0x00000000002F0000-0x000000000032E000-memory.dmp

Filesize
248KB

Download