241a608f43e6703756ec1a121405afce86871d26eaf1844c1cf2fc94e04a917f

General

Target
d2c6618c87a1f6c2676ecd1132118bb3.exe
Size 177KB
Sample240107-y6cbhsdgfl
SHA256 241a608f43e6703756ec1a121405afce86871d26eaf1844c1cf2fc94e04a917f
MD5 d2c6618c87a1f6c2676ecd1132118bb3
SHA1 020bf28ff1d84295ee639f9508ab17a36d44f0ab
SHA512 b02924c37d86dedff9eb22d4481fb8aca56383ebe1f6c7cb485743aeef8bb86f6eeba82d45a897f7f987c9782a65ee53c6a91731cb85db03f207f4cba7a8be4c
SSDEEP 3072:hsLS5UG73FRMUFJ9h15lpdBVZ8A0YY2Vg3q/haR5sS+vfvLHhjh8g1eGFyOsa:US5D7VyUFJ9h15lpdBVZ8A0YY2Vga/hp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d2c6618c87a1f6c2676ecd1132118bb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d2c6618c87a1f6c2676ecd1132118bb3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe

Malware Dropper & Backdoor - Berbew 2 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000300000001e982-8.dat	family_berbew
behavioral2/files/0x000300000001e982-7.dat	family_berbew

Executes dropped EXE 2 IoCs

pid	Process
4392	Nggqoj32.exe
4992	Nkcmohbg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nggqoj32.exe	d2c6618c87a1f6c2676ecd1132118bb3.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	d2c6618c87a1f6c2676ecd1132118bb3.exe
File created	C:\Windows\SysWOW64\Addjcmqn.dll	d2c6618c87a1f6c2676ecd1132118bb3.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nggqoj32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nggqoj32.exe

Program crash 1 IoCs

pid	pid_target	Process
4976	4992	WerFault.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d2c6618c87a1f6c2676ecd1132118bb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d2c6618c87a1f6c2676ecd1132118bb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	d2c6618c87a1f6c2676ecd1132118bb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d2c6618c87a1f6c2676ecd1132118bb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	d2c6618c87a1f6c2676ecd1132118bb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	d2c6618c87a1f6c2676ecd1132118bb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nggqoj32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4392	2568	d2c6618c87a1f6c2676ecd1132118bb3.exe	22
PID 2568 wrote to memory of 4392	2568	d2c6618c87a1f6c2676ecd1132118bb3.exe	22
PID 2568 wrote to memory of 4392	2568	d2c6618c87a1f6c2676ecd1132118bb3.exe	22
PID 4392 wrote to memory of 4992	4392	Nggqoj32.exe	21
PID 4392 wrote to memory of 4992	4392	Nggqoj32.exe	21
PID 4392 wrote to memory of 4992	4392	Nggqoj32.exe	21

C:\Users\Admin\AppData\Local\Temp\d2c6618c87a1f6c2676ecd1132118bb3.exe
"C:\Users\Admin\AppData\Local\Temp\d2c6618c87a1f6c2676ecd1132118bb3.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\Nggqoj32.exe
  C:\Windows\system32\Nggqoj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4992 -ip 4992
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 400
1⤵
- Program crash
PID:4976

C:\Windows\SysWOW64\Nkcmohbg.exe
C:\Windows\system32\Nkcmohbg.exe
1⤵
- Executes dropped EXE
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nggqoj32.exe

Path C:\Windows\SysWOW64\Nggqoj32.exe
Size 177KB
SHA256 102e15a2d84229876d08b782e6841619a98602727bd50d96b8f83c79f7da6d1a
MD5 5aa71191117f8bb7b81bc25b01cf2ca5
SHA1 f3a7a2bc6bdc933893d44430c5ab7854de86b5f6
SHA512 fd1dfae6bd02634803a817c32f66026e756158e8a761808c2a838c783bd60e44f369befc242e3738061313518acd684ffe6ed2f7c17dd02c5debeacb844ca01c
SSDEEP 3072:Aw3R/hpMkvmdtn1tg3q/haR5sS+vfvLHhjh8g1eGFyOsa:AwHw1tga/harSvLHh98gwG0ON
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nggqoj32.exe

Path C:\Windows\SysWOW64\Nggqoj32.exe
Size 92KB
SHA256 126dd8af7b16f98f606fd06500886f8b55cbdd5da522484f02c655d1e9ca84a9
MD5 63811467b3e199a07d1da6ef8c95d271
SHA1 2888f98bd62a48aba426c8d414b07639e448f9b8
SHA512 500cc679c593dfb20b6fc8866e774a4717758ece0cb373d61ca6dc59fc7c4d6cb98bce7747071f0c22b2b3c16ac670389d160c98264d8cf9067cc028ceb1d698
SSDEEP 1536:nAw3t//8ex3rTxNGkvDn98tPFtIyXysc0tO53q52IrFzTXMtDhGJ5taRF2:Aw3R/hpMkvmdtn1tg3q/haR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2568-19-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2568-1-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4392-13-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4992-17-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4992-18-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads