a4b2f5fb4b8f67b065132aafb4d0e7ad50503cc0fcc58d1a9fd8252693ef519a

General

Target

0a041b2c3b560ed2f165ce689b1a7b09.exe
Size

909KB
MD5

0a041b2c3b560ed2f165ce689b1a7b09
SHA1

1a1d0f890a792aaab6d7fc667f1aa7694f0f81fb
SHA256

a4b2f5fb4b8f67b065132aafb4d0e7ad50503cc0fcc58d1a9fd8252693ef519a
SHA512

0ea003d8fc15e171f81663597950fedca32f0ab8b98b0ea7e7d2490cceb3d128444afe31014ed440a628437a1b52a16e3f95c7f806ba53c465e6fccfd8cce0c3
SSDEEP

24576:9rtTGoSpY4Jro3TpBypjhqWgstIA5qlLZu5MO4we2G9CEzlpd68EW:f+r2TpBypjhqWgstIA0ZZu5MO4p2cCEZ

Score

10^/10

Malware Config

Signatures

Malware Backdoor - Berbew 6 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/files/0x0007000000015c50-5.dat	family_berbew
behavioral1/files/0x0007000000015c50-13.dat	family_berbew
behavioral1/files/0x0007000000015c50-9.dat	family_berbew
behavioral1/files/0x0007000000015c50-25.dat	family_berbew
behavioral1/files/0x0007000000015c50-24.dat	family_berbew
behavioral1/files/0x0007000000015c50-26.dat	family_berbew

Executes dropped EXE 1 IoCs

pid	Process
2284	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
2564	0a041b2c3b560ed2f165ce689b1a7b09.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cwnNfSv\svchost.exe	0a041b2c3b560ed2f165ce689b1a7b09.exe
File opened for modification	C:\Windows\SysWOW64\cwnNfSv\svchost.exe	0a041b2c3b560ed2f165ce689b1a7b09.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\TAHQbxB.dll	0a041b2c3b560ed2f165ce689b1a7b09.exe
File created	C:\Windows\lcgMRsO.dll	svchost.exe
File created	C:\Windows\AURHsXh\jrdRppyF.dll	svchost.exe
File opened for modification	C:\Windows\AURHsXh\jrdRppyF.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	2284	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2284	svchost.exe
2284	svchost.exe
2284	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2284	2564	0a041b2c3b560ed2f165ce689b1a7b09.exe	28
PID 2564 wrote to memory of 2284	2564	0a041b2c3b560ed2f165ce689b1a7b09.exe	28
PID 2564 wrote to memory of 2284	2564	0a041b2c3b560ed2f165ce689b1a7b09.exe	28
PID 2564 wrote to memory of 2284	2564	0a041b2c3b560ed2f165ce689b1a7b09.exe	28
PID 2284 wrote to memory of 2588	2284	svchost.exe	31
PID 2284 wrote to memory of 2588	2284	svchost.exe	31
PID 2284 wrote to memory of 2588	2284	svchost.exe	31
PID 2284 wrote to memory of 2588	2284	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\0a041b2c3b560ed2f165ce689b1a7b09.exe
"C:\Users\Admin\AppData\Local\Temp\0a041b2c3b560ed2f165ce689b1a7b09.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\cwnNfSv\svchost.exe
  "C:\Windows\SysWOW64\cwnNfSv\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 664
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\cwnNfSv\svchost.exe

Filesize
915KB

MD5
9b92cbae41fa56d145289ffc8ad5db1f

SHA1
c8597d73c3de12363e7cac02a75e1f25eb77f2b6

SHA256
d1a5de6d130fa4c97fc0a3bff1883188d8390510811b66bf75eca262d0383e78

SHA512
39e3465cbe813a7b162acc2e29e18582f52a75f4e4e4db10cdc44e1c78c795b1dbd547e4bff7755b5e29c926775360f43c9fdee7d48e8f43a159102a74b0eaee

Download Submit
C:\Windows\SysWOW64\cwnNfSv\svchost.exe

Filesize
915KB

MD5
9b92cbae41fa56d145289ffc8ad5db1f

SHA1
c8597d73c3de12363e7cac02a75e1f25eb77f2b6

SHA256
d1a5de6d130fa4c97fc0a3bff1883188d8390510811b66bf75eca262d0383e78

SHA512
39e3465cbe813a7b162acc2e29e18582f52a75f4e4e4db10cdc44e1c78c795b1dbd547e4bff7755b5e29c926775360f43c9fdee7d48e8f43a159102a74b0eaee

Download Submit
\Windows\SysWOW64\cwnNfSv\svchost.exe

Filesize
915KB

MD5
9b92cbae41fa56d145289ffc8ad5db1f

SHA1
c8597d73c3de12363e7cac02a75e1f25eb77f2b6

SHA256
d1a5de6d130fa4c97fc0a3bff1883188d8390510811b66bf75eca262d0383e78

SHA512
39e3465cbe813a7b162acc2e29e18582f52a75f4e4e4db10cdc44e1c78c795b1dbd547e4bff7755b5e29c926775360f43c9fdee7d48e8f43a159102a74b0eaee

Download Submit
\Windows\SysWOW64\cwnNfSv\svchost.exe

Filesize
915KB

MD5
9b92cbae41fa56d145289ffc8ad5db1f

SHA1
c8597d73c3de12363e7cac02a75e1f25eb77f2b6

SHA256
d1a5de6d130fa4c97fc0a3bff1883188d8390510811b66bf75eca262d0383e78

SHA512
39e3465cbe813a7b162acc2e29e18582f52a75f4e4e4db10cdc44e1c78c795b1dbd547e4bff7755b5e29c926775360f43c9fdee7d48e8f43a159102a74b0eaee

Download Submit
\Windows\SysWOW64\cwnNfSv\svchost.exe

Filesize
915KB

MD5
9b92cbae41fa56d145289ffc8ad5db1f

SHA1
c8597d73c3de12363e7cac02a75e1f25eb77f2b6

SHA256
d1a5de6d130fa4c97fc0a3bff1883188d8390510811b66bf75eca262d0383e78

SHA512
39e3465cbe813a7b162acc2e29e18582f52a75f4e4e4db10cdc44e1c78c795b1dbd547e4bff7755b5e29c926775360f43c9fdee7d48e8f43a159102a74b0eaee

Download Submit
\Windows\SysWOW64\cwnNfSv\svchost.exe

Filesize
915KB

MD5
9b92cbae41fa56d145289ffc8ad5db1f

SHA1
c8597d73c3de12363e7cac02a75e1f25eb77f2b6

SHA256
d1a5de6d130fa4c97fc0a3bff1883188d8390510811b66bf75eca262d0383e78

SHA512
39e3465cbe813a7b162acc2e29e18582f52a75f4e4e4db10cdc44e1c78c795b1dbd547e4bff7755b5e29c926775360f43c9fdee7d48e8f43a159102a74b0eaee

Download Submit
memory/2284-10-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2284-16-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2564-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2564-8-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing