Analysis

  • max time kernel
    89s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    16-09-2024 11:09

General

  • Target

    Backdoor.Win32.Berbew.exe

  • Size

    76KB

  • MD5

    da02ba2c614d43399c49db8b311cae70

  • SHA1

    2e4f75630f125096d6676e2d0e978a9e6f67e861

  • SHA256

    63fbe941ea05ed64840ae770b72c1f842147be1b95df899c8928dc2cfdb0fef0

  • SHA512

    3e1772f0c69726e198cf07cc6dac5f479864f2090f48e2a8ece44e7a989223640c35718974bf39600bb0b288a4430bd69160c2a6aa9de0753419d34f2342055b

  • SSDEEP

    1536:QKYuhP7sZMZlHMUCQOdgdYNVSbX5xoUWHioQV+/eCeyvCQ:Jlhz2MZlsUCkWHrk+

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 22 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 22 IoCs
  • Drops file in System32 directory 33 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 36 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Berbew.exe
    "C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Berbew.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\SysWOW64\Cobhdhha.exe
      C:\Windows\system32\Cobhdhha.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\SysWOW64\Capdpcge.exe
        C:\Windows\system32\Capdpcge.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Windows\SysWOW64\Chjmmnnb.exe
          C:\Windows\system32\Chjmmnnb.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Windows\SysWOW64\Ccpqjfnh.exe
            C:\Windows\system32\Ccpqjfnh.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2288
            • C:\Windows\SysWOW64\Cenmfbml.exe
              C:\Windows\system32\Cenmfbml.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2708
              • C:\Windows\SysWOW64\Chmibmlo.exe
                C:\Windows\system32\Chmibmlo.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2736
                • C:\Windows\SysWOW64\Cofaog32.exe
                  C:\Windows\system32\Cofaog32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2752
                  • C:\Windows\SysWOW64\Caenkc32.exe
                    C:\Windows\system32\Caenkc32.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2268
                    • C:\Windows\SysWOW64\Cdcjgnbc.exe
                      C:\Windows\system32\Cdcjgnbc.exe
                      10⤵
                      • Adds autorun key to be loaded by Explorer.exe on startup
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:444
                      • C:\Windows\SysWOW64\Cgbfcjag.exe
                        C:\Windows\system32\Cgbfcjag.exe
                        11⤵
                        • Adds autorun key to be loaded by Explorer.exe on startup
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:3056
                        • C:\Windows\SysWOW64\Coindgbi.exe
                          C:\Windows\system32\Coindgbi.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Caenkc32.exe

    Filesize

    76KB

    MD5

    bc7f0c7acef9f199b7efebd9b217f47e

    SHA1

    65256da27ea36710e0ae7431d74691c6266d600f

    SHA256

    a02f1ffc77581ce2a7369152f7302b7c5a5959be930a35f33bb0ba929eab493e

    SHA512

    8124060cb666c7384a9f548e9eca2bed8d17e7c3958bd4182e53a2bba3edc337d0f5930514d97b484f31bf431c6a694730a06a7a94537d9b3491a4b183120f4e

  • C:\Windows\SysWOW64\Capdpcge.exe

    Filesize

    76KB

    MD5

    27fa79d3de4e40585b0857cbe422003e

    SHA1

    c51f8e4b377e7f352b092006f528853b394c1147

    SHA256

    dda0abf35fe9db02cff0bc5cf9872d9c775e490c97b390a1419506563ed44528

    SHA512

    4853f55ac71cebba9178829fdbd40caf5b1d18f6f75b1ec9313edc0665ba1865ba982e9ad110f746ecf6869969561edfb26c5d249b4b45738e4295fd608de142

  • C:\Windows\SysWOW64\Cdcjgnbc.exe

    Filesize

    76KB

    MD5

    acaeab15c633bb829638bafee9dea25c

    SHA1

    6124ffdf6ea9bf7bc3bbc7712b0a918be6824645

    SHA256

    efdf4e70654be3831323c7fd33b15e9bf81e5e932a43fbd288e0b4a41b966dd6

    SHA512

    c214221d45105f69591a9df3b4d9c8316989417271b098fc93bc6fc95dee77b52db8834f00f1c14122cf0fc8282ba33251be43da65b65fb72c6dcda5e94f1fe3

  • C:\Windows\SysWOW64\Cenmfbml.exe

    Filesize

    76KB

    MD5

    341b67f58bbc0da9aa7e9848c0d61b64

    SHA1

    6daa4d0bfc28e61a23a6125395e6d89e68547bb8

    SHA256

    d39b988d9298d0b6335f63ecc6202d8cc43ba8d0a2870a07975f093ba2a8f7b0

    SHA512

    37b9729a3d449b4b5af1940bd41604eed33b9f3fce1b9df7d4c01ce6fb66a0166f380b79c7e2bf66898cfae6baf4712d50f10755ca2bc84868ca81a9a597531e

  • C:\Windows\SysWOW64\Chjmmnnb.exe

    Filesize

    76KB

    MD5

    59019af6b32f3d30a79c68a4962af2b6

    SHA1

    a0c07fc3b29254897b9046e15c893779cee58511

    SHA256

    e26d3ed443b02330468a8de2c648c7cd5e6d8ef7ba0d85a467a10747ddf29234

    SHA512

    4e9ab798930dbf8a00cb4b04c0bb92c722a55248527182f4f1d2f19ebbb361e02f7317c360d0b31fbceb272fcb6367d85eeec94b61cd50d88dc7474167489a5d

  • \Windows\SysWOW64\Ccpqjfnh.exe

    Filesize

    76KB

    MD5

    2b79cbc05b6c7322bd09915a0ff71476

    SHA1

    0ee82ae6a2c80b1d9fa47a1afb291e6a11834d60

    SHA256

    268b06bde9486cf88121030cf48273b809f1656d87e41c697f4211efa8f44897

    SHA512

    ab647472181d2967799d88940a5258d9612898b2a61ad501346317fb9d672c7178e1739c2695c431d09cdb2550bdb727e8b65ee8b9034e66e8a74ff76cb4525d

  • \Windows\SysWOW64\Cgbfcjag.exe

    Filesize

    76KB

    MD5

    50f7672f2fb3f166e15b12324d065ddc

    SHA1

    bde7d27732e8ad04acdef4636e07bd5dbe154a6c

    SHA256

    5027884aebb434d66f4a990ad1a2c7f7f7021dc2edd0604072d774ae91c441ef

    SHA512

    dbdd2c23df3fec31ba2a4954582f50817cdb362f6a57ac57106e5aa6b9981ec50cf0161a43e31bae7ac68729b0b908745e82e10758fc8c69007807e97c2c250e

  • \Windows\SysWOW64\Chmibmlo.exe

    Filesize

    76KB

    MD5

    7ece7d9fbe5d5c626b4b5ab5b158d361

    SHA1

    e6afd4f8f0743d58f1c754d24bd979d80b2ba53c

    SHA256

    e1bad93c32f46e66eb01860743f66d3eb86d9fd03c99715133b7af506f4a3100

    SHA512

    5bf17028cee9b8dc4e9ab687ccb887966675a5a84bc6d1691753868109cdff7e75d576e54f6bf4b1342c73f141d37b0641d14e77a761505296b62d724d6ec4b4

  • \Windows\SysWOW64\Cobhdhha.exe

    Filesize

    76KB

    MD5

    5b4094b39f015d3eb9707f09fc82a327

    SHA1

    788a916c86aef59a39960d45326e45d33a734bb4

    SHA256

    7a9291ad23a8c68eadc8901987ab1d2e6fb5595802ef489dc568bae9279cae36

    SHA512

    8fef6782f9298f1c53ddc369c48fa49863e2b85a3b2ada6e91b38d1a7a830b1fae81bac480bbfad7114b7ab3fdf469d13f4051d7399026b2a02c82585dc254d4

  • \Windows\SysWOW64\Cofaog32.exe

    Filesize

    76KB

    MD5

    1f48a20b9e1c7ca92a0364943237a0e5

    SHA1

    f318070ac1e168582a8978f6aebaeb5d9b6a2813

    SHA256

    2a44b3a3ac6e6cd59e38682f2a50657c61b1c8375ade4c20e26af310d882ae48

    SHA512

    2de87564bfdbb3115df4cea5893089425ea24e113dc80f1001c7c6a282f41fa66506b0475fb94157ae9d17f783f4df933fb0b72090cd41531f47ea79f79b2ba5

  • \Windows\SysWOW64\Coindgbi.exe

    Filesize

    76KB

    MD5

    8f91a31afc6890c01a6235c4e39495d3

    SHA1

    0e5b29eeae6fb7e9b8f0cc7e71e804c334fe4c95

    SHA256

    42ac71821f1c1a24145871f1ac98e57b059049b1a8ca2f6e08c8a7766626afdd

    SHA512

    d5c77cfa4bd1c2f7d6aa95dcdff402537fb8794a5f9cc4603923c3755c9b0c0e397ca51897a9e3b429a73e9a8f0d89e52fe92e1b300db6d954b2d548b7b6ab0b

  • memory/444-127-0x00000000002D0000-0x0000000000310000-memory.dmp

    Filesize

    256KB

  • memory/444-154-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/1088-145-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/1088-156-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2216-14-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2216-147-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2268-153-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2268-115-0x00000000002D0000-0x0000000000310000-memory.dmp

    Filesize

    256KB

  • memory/2288-62-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/2288-149-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2708-150-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2708-75-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/2736-88-0x00000000002D0000-0x0000000000310000-memory.dmp

    Filesize

    256KB

  • memory/2736-151-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2748-0-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2748-146-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2748-12-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/2748-13-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/2752-152-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2752-105-0x0000000000260000-0x00000000002A0000-memory.dmp

    Filesize

    256KB

  • memory/2880-148-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2880-40-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2880-47-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/2880-53-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/2884-32-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/3056-155-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB