berbew | 18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974

Analysis

max time kernel
111s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Size

205KB
MD5

f3b24f1683a93cec9efa5d1112fa09f0
SHA1

e643b72b157123642039f3c820b0127d82fcca37
SHA256

18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974
SHA512

f0571be223c3053766e8f8ddbfa459f0bfdb03230c60b790010fde9648fa2fcf817a4e9854ff5b1ce1cf1163f4f3ab6aeee125ebd071a84e2b7632355567c862
SSDEEP

6144:SAC3EqfQbeGyZ6YugQdjGG1wsKm6eBgdQbz:SAsEqfQKGyXu1jGG1wsGeBg8

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eccmffjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enhacojl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbfdjdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlnbeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edkcojga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqbddk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emnndlod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Effcma32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhbfdjdp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Effcma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efcfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emnndlod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfdjhndl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlnbeh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkcojga.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Endhhp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqbddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfffnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eccmffjf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efcfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfffnn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhacojl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 13 IoCs

pid	Process
2736	Dfdjhndl.exe
2776	Dhbfdjdp.exe
2612	Dlnbeh32.exe
2524	Dfffnn32.exe
2984	Edkcojga.exe
692	Endhhp32.exe
1488	Eqbddk32.exe
2820	Eccmffjf.exe
1912	Enhacojl.exe
760	Efcfga32.exe
2500	Emnndlod.exe
1944	Effcma32.exe
1628	Fkckeh32.exe

Loads dropped DLL 30 IoCs

pid	Process
2104	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
2104	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
2736	Dfdjhndl.exe
2736	Dfdjhndl.exe
2776	Dhbfdjdp.exe
2776	Dhbfdjdp.exe
2612	Dlnbeh32.exe
2612	Dlnbeh32.exe
2524	Dfffnn32.exe
2524	Dfffnn32.exe
2984	Edkcojga.exe
2984	Edkcojga.exe
692	Endhhp32.exe
692	Endhhp32.exe
1488	Eqbddk32.exe
1488	Eqbddk32.exe
2820	Eccmffjf.exe
2820	Eccmffjf.exe
1912	Enhacojl.exe
1912	Enhacojl.exe
760	Efcfga32.exe
760	Efcfga32.exe
2500	Emnndlod.exe
2500	Emnndlod.exe
1944	Effcma32.exe
1944	Effcma32.exe
2504	WerFault.exe
2504	WerFault.exe
2504	WerFault.exe
2504	WerFault.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eqbddk32.exe	Endhhp32.exe
File opened for modification	C:\Windows\SysWOW64\Enhacojl.exe	Eccmffjf.exe
File created	C:\Windows\SysWOW64\Endhhp32.exe	Edkcojga.exe
File opened for modification	C:\Windows\SysWOW64\Efcfga32.exe	Enhacojl.exe
File created	C:\Windows\SysWOW64\Fkckeh32.exe	Effcma32.exe
File created	C:\Windows\SysWOW64\Clkmne32.dll	Effcma32.exe
File created	C:\Windows\SysWOW64\Oghiae32.dll	Dfdjhndl.exe
File created	C:\Windows\SysWOW64\Edkcojga.exe	Dfffnn32.exe
File created	C:\Windows\SysWOW64\Gogcek32.dll	Dfffnn32.exe
File created	C:\Windows\SysWOW64\Eccmffjf.exe	Eqbddk32.exe
File created	C:\Windows\SysWOW64\Fdilpjih.dll	Enhacojl.exe
File opened for modification	C:\Windows\SysWOW64\Emnndlod.exe	Efcfga32.exe
File opened for modification	C:\Windows\SysWOW64\Effcma32.exe	Emnndlod.exe
File created	C:\Windows\SysWOW64\Affcmdmb.dll	Emnndlod.exe
File opened for modification	C:\Windows\SysWOW64\Dhbfdjdp.exe	Dfdjhndl.exe
File opened for modification	C:\Windows\SysWOW64\Endhhp32.exe	Edkcojga.exe
File created	C:\Windows\SysWOW64\Lfnjef32.dll	Endhhp32.exe
File created	C:\Windows\SysWOW64\Nnfbei32.dll	Dhbfdjdp.exe
File created	C:\Windows\SysWOW64\Aabagnfc.dll	Edkcojga.exe
File created	C:\Windows\SysWOW64\Ampehe32.dll	Eccmffjf.exe
File created	C:\Windows\SysWOW64\Dfdjhndl.exe	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
File created	C:\Windows\SysWOW64\Eqbddk32.exe	Endhhp32.exe
File created	C:\Windows\SysWOW64\Effcma32.exe	Emnndlod.exe
File created	C:\Windows\SysWOW64\Focnmm32.dll	Dlnbeh32.exe
File opened for modification	C:\Windows\SysWOW64\Eccmffjf.exe	Eqbddk32.exe
File created	C:\Windows\SysWOW64\Imehcohk.dll	Eqbddk32.exe
File created	C:\Windows\SysWOW64\Efcfga32.exe	Enhacojl.exe
File created	C:\Windows\SysWOW64\Inegme32.dll	Efcfga32.exe
File opened for modification	C:\Windows\SysWOW64\Dfdjhndl.exe	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
File created	C:\Windows\SysWOW64\Jdjfho32.dll	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
File created	C:\Windows\SysWOW64\Dlnbeh32.exe	Dhbfdjdp.exe
File opened for modification	C:\Windows\SysWOW64\Edkcojga.exe	Dfffnn32.exe
File created	C:\Windows\SysWOW64\Enhacojl.exe	Eccmffjf.exe
File created	C:\Windows\SysWOW64\Emnndlod.exe	Efcfga32.exe
File opened for modification	C:\Windows\SysWOW64\Fkckeh32.exe	Effcma32.exe
File created	C:\Windows\SysWOW64\Dhbfdjdp.exe	Dfdjhndl.exe
File opened for modification	C:\Windows\SysWOW64\Dlnbeh32.exe	Dhbfdjdp.exe
File created	C:\Windows\SysWOW64\Dfffnn32.exe	Dlnbeh32.exe
File opened for modification	C:\Windows\SysWOW64\Dfffnn32.exe	Dlnbeh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	1628	WerFault.exe	42

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbfdjdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eccmffjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emnndlod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Effcma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Endhhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efcfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkckeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqbddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enhacojl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfdjhndl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlnbeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfffnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edkcojga.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfdjhndl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emnndlod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnfbei32.dll"	Dhbfdjdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dlnbeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfffnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfnjef32.dll"	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eqbddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emnndlod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogcek32.dll"	Dfffnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aabagnfc.dll"	Edkcojga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Endhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eccmffjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Effcma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdjfho32.dll"	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oghiae32.dll"	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efcfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dlnbeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eccmffjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdilpjih.dll"	Enhacojl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Effcma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhbfdjdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Enhacojl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enhacojl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inegme32.dll"	Efcfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Affcmdmb.dll"	Emnndlod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Focnmm32.dll"	Dlnbeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edkcojga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edkcojga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Endhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eqbddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imehcohk.dll"	Eqbddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampehe32.dll"	Eccmffjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhbfdjdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfffnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efcfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll"	Effcma32.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2736	2104	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe	30
PID 2104 wrote to memory of 2736	2104	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe	30
PID 2104 wrote to memory of 2736	2104	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe	30
PID 2104 wrote to memory of 2736	2104	18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe	30
PID 2736 wrote to memory of 2776	2736	Dfdjhndl.exe	31
PID 2736 wrote to memory of 2776	2736	Dfdjhndl.exe	31
PID 2736 wrote to memory of 2776	2736	Dfdjhndl.exe	31
PID 2736 wrote to memory of 2776	2736	Dfdjhndl.exe	31
PID 2776 wrote to memory of 2612	2776	Dhbfdjdp.exe	32
PID 2776 wrote to memory of 2612	2776	Dhbfdjdp.exe	32
PID 2776 wrote to memory of 2612	2776	Dhbfdjdp.exe	32
PID 2776 wrote to memory of 2612	2776	Dhbfdjdp.exe	32
PID 2612 wrote to memory of 2524	2612	Dlnbeh32.exe	33
PID 2612 wrote to memory of 2524	2612	Dlnbeh32.exe	33
PID 2612 wrote to memory of 2524	2612	Dlnbeh32.exe	33
PID 2612 wrote to memory of 2524	2612	Dlnbeh32.exe	33
PID 2524 wrote to memory of 2984	2524	Dfffnn32.exe	34
PID 2524 wrote to memory of 2984	2524	Dfffnn32.exe	34
PID 2524 wrote to memory of 2984	2524	Dfffnn32.exe	34
PID 2524 wrote to memory of 2984	2524	Dfffnn32.exe	34
PID 2984 wrote to memory of 692	2984	Edkcojga.exe	35
PID 2984 wrote to memory of 692	2984	Edkcojga.exe	35
PID 2984 wrote to memory of 692	2984	Edkcojga.exe	35
PID 2984 wrote to memory of 692	2984	Edkcojga.exe	35
PID 692 wrote to memory of 1488	692	Endhhp32.exe	36
PID 692 wrote to memory of 1488	692	Endhhp32.exe	36
PID 692 wrote to memory of 1488	692	Endhhp32.exe	36
PID 692 wrote to memory of 1488	692	Endhhp32.exe	36
PID 1488 wrote to memory of 2820	1488	Eqbddk32.exe	37
PID 1488 wrote to memory of 2820	1488	Eqbddk32.exe	37
PID 1488 wrote to memory of 2820	1488	Eqbddk32.exe	37
PID 1488 wrote to memory of 2820	1488	Eqbddk32.exe	37
PID 2820 wrote to memory of 1912	2820	Eccmffjf.exe	38
PID 2820 wrote to memory of 1912	2820	Eccmffjf.exe	38
PID 2820 wrote to memory of 1912	2820	Eccmffjf.exe	38
PID 2820 wrote to memory of 1912	2820	Eccmffjf.exe	38
PID 1912 wrote to memory of 760	1912	Enhacojl.exe	39
PID 1912 wrote to memory of 760	1912	Enhacojl.exe	39
PID 1912 wrote to memory of 760	1912	Enhacojl.exe	39
PID 1912 wrote to memory of 760	1912	Enhacojl.exe	39
PID 760 wrote to memory of 2500	760	Efcfga32.exe	40
PID 760 wrote to memory of 2500	760	Efcfga32.exe	40
PID 760 wrote to memory of 2500	760	Efcfga32.exe	40
PID 760 wrote to memory of 2500	760	Efcfga32.exe	40
PID 2500 wrote to memory of 1944	2500	Emnndlod.exe	41
PID 2500 wrote to memory of 1944	2500	Emnndlod.exe	41
PID 2500 wrote to memory of 1944	2500	Emnndlod.exe	41
PID 2500 wrote to memory of 1944	2500	Emnndlod.exe	41
PID 1944 wrote to memory of 1628	1944	Effcma32.exe	42
PID 1944 wrote to memory of 1628	1944	Effcma32.exe	42
PID 1944 wrote to memory of 1628	1944	Effcma32.exe	42
PID 1944 wrote to memory of 1628	1944	Effcma32.exe	42
PID 1628 wrote to memory of 2504	1628	Fkckeh32.exe	43
PID 1628 wrote to memory of 2504	1628	Fkckeh32.exe	43
PID 1628 wrote to memory of 2504	1628	Fkckeh32.exe	43
PID 1628 wrote to memory of 2504	1628	Fkckeh32.exe	43

C:\Users\Admin\AppData\Local\Temp\18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe
"C:\Users\Admin\AppData\Local\Temp\18ceb49d31865bc3e041fe67f6978e8841d846912b162b304a8258a713db7974N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\Dfdjhndl.exe
  C:\Windows\system32\Dfdjhndl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\Dhbfdjdp.exe
    C:\Windows\system32\Dhbfdjdp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\Dlnbeh32.exe
      C:\Windows\system32\Dlnbeh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\SysWOW64\Dfffnn32.exe
        
        C:\Windows\system32\Dfffnn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
      - C:\Windows\SysWOW64\Edkcojga.exe
        
        C:\Windows\system32\Edkcojga.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Endhhp32.exe
        
        C:\Windows\system32\Endhhp32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\Eqbddk32.exe
        
        C:\Windows\system32\Eqbddk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Eccmffjf.exe
        
        C:\Windows\system32\Eccmffjf.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Enhacojl.exe
        
        C:\Windows\system32\Enhacojl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Efcfga32.exe
        
        C:\Windows\system32\Efcfga32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Emnndlod.exe
        
        C:\Windows\system32\Emnndlod.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Effcma32.exe
        
        C:\Windows\system32\Effcma32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\Fkckeh32.exe
        
        C:\Windows\system32\Fkckeh32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 140
        15⤵
        Loads dropped DLL
        Program crash
        
        PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dhbfdjdp.exe

Filesize
205KB

MD5
c4bb6ef61c0be72ba78e9b43503303bc

SHA1
672ecdec3b38a3ef3aa3068e04af7a380b3e69d0

SHA256
1faf9b1f30e855990d3916266b2be3488aed6bac40e91f6a050f538381c15e9c

SHA512
884ccb6e6dcb3e30fd7969fa045ace10b601c2bdbd5999442bb28664e8a2e565b02b0305b8722e511b0908f05dd44d37883346381e33f5c203d98566880455ff

Download Submit
C:\Windows\SysWOW64\Eqbddk32.exe

Filesize
205KB

MD5
6e438b07a30acd1082b64fdc7da2ef2c

SHA1
0ca97ad6b7357832e85717c0d241b4d2cd9f9324

SHA256
7fdae82ceb4eae15cfbf55b1e1f4f4a36899e23323821cf390e737e794af68ea

SHA512
4e5d907df38adbafaae75a530aeec32ff7346080e4ddd127e95565748347f1ff8f05db4f6db07373042a7ab24c1f360a9315453300b0f913b6dfa0a12e5fc9d3

Download Submit
C:\Windows\SysWOW64\Gogcek32.dll

Filesize
7KB

MD5
00c6385db5befb9ca3104ac92293d8c1

SHA1
1315a00006d7ff8d61aa2ebe5513278854b68ef3

SHA256
aefe36dac950ef4f500b04e4f1bfb3caa954523bedbed92ff0a8d43a3a7b14db

SHA512
b3d09170920b34725e44e0a1ef60df889bd3305503760e9f5d909aed47e77eefdfe0573959da78f702adf4ccb53305fa96074508d70abc500235a5d2afb777f6

Download Submit
\Windows\SysWOW64\Dfdjhndl.exe

Filesize
205KB

MD5
8b36320aa0b627ee4252c7e578863b41

SHA1
b8d845a725bcae6d3ef1d782bdaa1e4bdc90baed

SHA256
ebccb2a889c811e48cca15ffddc7aea03c70aead2db3e43a8a742d887a98878c

SHA512
65b32a012a3e3193c3c4cc632629a2d428c75f75809d5c6121611f26af03f6b5e16b9a2767b9641066512931a0d7ac52db0be6ee1b68b5b1e1bcb6fbeb216f00

Download Submit
\Windows\SysWOW64\Dfffnn32.exe

Filesize
205KB

MD5
b92fbcbf2ef1e596382e99826ea70607

SHA1
464bb6b462ed5e053e874e40987b905ea6971331

SHA256
b2249888b71e6e73e73f5ca8bb8f6f5734c8433a8a71338fa3c8906c61e490b4

SHA512
5cef0a1aa93b49f3be4b0ab4b148bf138b67f324da525d86a34cef389862480789c887c202f597c5c03f86993041c69bd53a7b8e2123cdac7c86c0e731d07888

Download Submit
\Windows\SysWOW64\Dlnbeh32.exe

Filesize
205KB

MD5
63dba17865914f80ff6f79d7c0b08b1a

SHA1
b53d1d0edd4a54adec33c9e03007a7783cfb9f49

SHA256
f41335dbec7aff9fc293d8c76553fdc11ba2d3a8ecb3ce878c59df608b858a93

SHA512
1a7bbd8d00f3810454250d4a87dde5f5789cc918b46793391b26322e3e31b7a786b72599c56d08e836e278eb0fa31e3d0b68441e05f8638540cd68b20d44246a

Download Submit
\Windows\SysWOW64\Eccmffjf.exe

Filesize
205KB

MD5
35653b17a19368f9bc3ecbdb036650c7

SHA1
51a872138a6672c4e1b23108fec8c8385abf8337

SHA256
345e108a31f9f7ce0853676bad528cf25a0d898faaf64d30afac95ea409c1dc5

SHA512
4423ed4ecc0175eb74d12782dc7fbcd05f4a95b2ef67fb977aeb65365d7fde9204529260edf9c20d7eddc4ac263a9e37ebddb7efb5a3bdb2440c9e7ae548dbb1

Download Submit
\Windows\SysWOW64\Edkcojga.exe

Filesize
205KB

MD5
50bf294a9cbe020dc849cd10565d0d50

SHA1
1da04230b1e1f86e3997cb0e3f15acdd8486cf6e

SHA256
057cbdc0d90543246a36a792a1087917202c3a45efa5d186597181bee4eea16f

SHA512
6c9b12c133353865ecbb25cf9a363e6b662217b2a89fe64c2315290feac0af1470c9f8960a38b90422d84fd2b4142ad975d33fb7f9510b49e4590da25f880614

Download Submit
\Windows\SysWOW64\Efcfga32.exe

Filesize
205KB

MD5
744f01be9e5c29c766432643e8baba9c

SHA1
e6e94b36cbc1f3d6808b312309803397696543e4

SHA256
fb14106a0a7481d19c8731b16829143c29178c2e66666a3b8319a81d922bdb5d

SHA512
c8ccd59614a099657ed6fcc511319f70c6aa390a2b3b6053bec6ee0b99d0ea9b64d790db0da58fed3dc5aa00c68a7bfd690057611094fa4c8348ea3ade782d63

Download Submit
\Windows\SysWOW64\Effcma32.exe

Filesize
205KB

MD5
1e952cfac219b11cda862803947ce8ac

SHA1
3cfd3d6ab0311d5653eb08ddb178881dfc93b031

SHA256
357b8ad844d9664334bc1aaa894dc4242a142b1848fc8d80aacff6d51a827273

SHA512
fb1a40481e2f4ac2dedec1276c058f8ede9427e35d380c8b7ad65398992b01dac690b11c86e2fdf915bda94050ee6b11ad284d4fa24ab4194cc999baa6bf2475

Download Submit
\Windows\SysWOW64\Emnndlod.exe

Filesize
205KB

MD5
f379e57e2a0be8407c4968b604d76eab

SHA1
d65fc828dbc0e65eb92db3b61465c575ac9ad6a2

SHA256
c0a2deca8554bf2750976cf8d7d4bf5a59a228dad455352b9318c035b4efd09a

SHA512
9eb9a3db4d7ad9e285681b0b7ee0806194edd246ddf8a35ff19b6afb0ef7e23f1db3d5086d3b3e57ed7694243a354c2dce24c8309bb1d1fb7755440aedbb309c

Download Submit
\Windows\SysWOW64\Endhhp32.exe

Filesize
205KB

MD5
2b06383878d4e0324729535d25f17ef9

SHA1
5da27f8c3e63bebeb1f8559bd58627349bd827be

SHA256
1c7278ef5f87912e30044408bd9125475202efe5d17718589aba32489c2d368a

SHA512
d748d20ce0296741a8606700c8f3682075717e8f29fa2a3c174dcfb293bd0f181b823ff8aa01b6c6c34313def5db19bde3d7f6c723afb65594f8ad4bfac4c7b8

Download Submit
\Windows\SysWOW64\Enhacojl.exe

Filesize
205KB

MD5
ac01d9e4afa496e4e7c21e90ae19fc78

SHA1
38929f7cfd74dcc54dce919cd0891b951cdd6252

SHA256
2ffdd0aaad3b8c1800d027cf6d5ee7c3a1f538b7a1de60ada7324f2fe9343f1e

SHA512
b9b6cea666ae8d500eb034101931cc3b03c36f334c353d6105c48a87f06e3d77d7d080900f4ec608d561c948b7816da57b326f56bce27e6ff147034ac16985bc

Download Submit
\Windows\SysWOW64\Fkckeh32.exe

Filesize
205KB

MD5
5805c28d714159d167636ef84feec250

SHA1
c5cf5a0a281672cb6db43ea4ff1d91ca7609a6d6

SHA256
dc95fb60645cafca805d094379e563c17addef2b2db803888dfae0274de2a351

SHA512
d00e430fbcbb81e1fa529543410c103418481a8201432d6c27111b75629f3f09f02cdafc428e1063a292597140c3ca0bc76d0fa20bd22ab4baa107f25d4c83ff

Download Submit
memory/692-95-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/692-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/692-83-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/760-190-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-187-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-103-0x0000000000280000-0x00000000002B4000-memory.dmp

Filesize
208KB

Download
memory/1628-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1628-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-123-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-131-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/1944-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2104-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2104-17-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2104-18-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2104-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2500-149-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2500-156-0x0000000000270000-0x00000000002A4000-memory.dmp

Filesize
208KB

Download
memory/2500-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-67-0x00000000005F0000-0x0000000000624000-memory.dmp

Filesize
208KB

Download
memory/2524-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2612-53-0x0000000000260000-0x0000000000294000-memory.dmp

Filesize
208KB

Download
memory/2612-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2736-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2776-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-121-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2820-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-80-0x0000000000250000-0x0000000000284000-memory.dmp

Filesize
208KB

Download
memory/2984-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads