Overview

overview

10

Static

static

10

677d42dab5...d4.exe

windows7-x64

10

677d42dab5...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    677d42dab5f1260959a5ec3656a35252724f770a3d950a3bc275df59867a27d4.exe

  • Size

    320KB

  • Sample

    240523-bbweksff2v

  • MD5

    068d8f21624fb5b69826633c90d54e40

  • SHA1

    b3bcb2a61645c1db90af9cf799c9ee3364f98fca

  • SHA256

    677d42dab5f1260959a5ec3656a35252724f770a3d950a3bc275df59867a27d4

  • SHA512

    3d16a5b3fc6714c6ec1fc6ef64391299bc9f94b2a4a145279bbd825f11347ed7c7112c680f0df4b819dc65fe6ff6898d008399add14bb1f80a3af97213183ea9

  • SSDEEP

    6144:iULb6DDwUfv4LAYCtE07kli0KoCYtw2B0Ddu9szWfx09UBIUbPLwH/lLOUaR/N1O:rmPzHYJ07kE0KoFtw2gu9RxrBIUbPLwz

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      677d42dab5f1260959a5ec3656a35252724f770a3d950a3bc275df59867a27d4.exe

    • Size

      320KB

    • MD5

      068d8f21624fb5b69826633c90d54e40

    • SHA1

      b3bcb2a61645c1db90af9cf799c9ee3364f98fca

    • SHA256

      677d42dab5f1260959a5ec3656a35252724f770a3d950a3bc275df59867a27d4

    • SHA512

      3d16a5b3fc6714c6ec1fc6ef64391299bc9f94b2a4a145279bbd825f11347ed7c7112c680f0df4b819dc65fe6ff6898d008399add14bb1f80a3af97213183ea9

    • SSDEEP

      6144:iULb6DDwUfv4LAYCtE07kli0KoCYtw2B0Ddu9szWfx09UBIUbPLwH/lLOUaR/N1O:rmPzHYJ07kE0KoFtw2gu9RxrBIUbPLwz

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks