Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 16:27
General
-
Target
a4b8ec5a50493fd26893d36123428c16.exe
-
Size
419KB
-
MD5
a4b8ec5a50493fd26893d36123428c16
-
SHA1
219c5ea03e2d5910563437fd8aef193f7b32acb4
-
SHA256
9fab1db0a4ac894d7883bc992c467f5ea61f592f3a65969eb932cb21650c8b53
-
SHA512
75f6b294718d2ed3d8e72732342955aa5db6b48b155519c7a4e45f0a5aeb0360bb44969d96b8ec2a833cb94a40a31a59cd487c11cd45301e0383fadf18e6503c
-
SSDEEP
12288:QGkdVUm9VunNv3vhrUluVDFs5ekwI93TkH1m1pcEtQAO:QGkdVUm9VunNv3vhrUluVDFs5ekwI93k
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 5 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4b8ec5a50493fd26893d36123428c16.exe"C:\Users\Admin\AppData\Local\Temp\a4b8ec5a50493fd26893d36123428c16.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182KB
MD53f66a150a9aef8a4eb36667782d70dc1
SHA1310a56fd9f3c9cde97b205b2e027826efb8fcdcb
SHA256b850e87296848a88b6a4fcff8b9d05e9fd4d9a2dd9c93e546c046ca4fafc483a
SHA512e372a7fb85ec8695fca9ebb1666590b7800334dae12cfe944761cb790bb2fd9153af61f41770399d5e6877179460745c61d8ac54dbf52c82c2a78f9a97bbcdd1
-
Filesize
43KB
MD5133bd880a2f6657be1d7c1356177d505
SHA1c7e8095c1d6ff786b2267f450e2f64ba5fc5b27b
SHA25605b3b11051d1372ede2c538d366efb54a77df7f9ac30d8fc51efbb1f347b0eb8
SHA512eb9eb600c2462b7719205e05dbb4ca65e7a7bedcc0bb90eb113973653f9b6aa18668551f1b7590ff24da2d7170feea198b2e223d7bd6fcf73b092a05586ae005
-
Filesize
132KB
MD5105a1fe5f007d6b7b9dbed172884dcc9
SHA1cba517095392cf83cae5e241292ec4fa79ca0256
SHA25623ea17ea6675e9b2dba94a0f474bdf751cc0e6aa671eefdee4ed990197038696
SHA51232b271fca9e3a0bc90937b322e5118dfd2ee82383672f2c25db578b5e996d5627dfc0614246f606af11e0973540728d25b1f750b57003a560655cef14256e57d
-
Filesize
75KB
MD553176f48952e3ee5bcf95956dc780a82
SHA1952fbc209336a5a208ec6d451cf7350bebf4d5c2
SHA256ef3b9953bd71d7ad88041018bfc66de101b27114e0b95184e4d782a0f188b65c
SHA512ddd080c1bfaef30012c2c0e823d8835a0a1584746fa4f783ac38cde044156110126ef4dbfada165a15aaf0462ff5a74236d07360fd09a0152aec380807662b10
-
Filesize
135KB
MD598afb54b2551824c1028e789d13f9492
SHA192f58d52c4207a52e70665785f4c64222a3ba1eb
SHA256ca7d21947ab00b3fecaa23b18835cb02182170d1acbb554189066afa083828f2
SHA512d88591bf1abe7cd007f802a0391ddb8161772f7e554ab023b57249f65fa216a245e990183da43911fa463616a317594d67e6498a9ae2be9f512824a75fc0d340
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB