berbew | 8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501

General

Target

8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Size

96KB
MD5

1dcea81cf6bbc013cff8c746c070c890
SHA1

951ca378fab8e0165c30fba2e2a1f17a11e83108
SHA256

8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501
SHA512

36215da33c5ed70e4a8bbbe71639c172f73f7a527ac06e36cceee6e6c3b0abba392b8c9c9d968c553e81b0a923e9b8f430883247d2e578d893e282e9416cf071
SSDEEP

1536:U65KH2WGxGF0tmJlTOzfQX6adRQ+fmR5R45WtqV9R2R462izMg3R7ih9:qH2VxGsYOzfoBde+uHrtG9MW3+3l29

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cilibi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cilibi32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 2 IoCs

pid	Process
2712	Cilibi32.exe
2916	Cacacg32.exe

Loads dropped DLL 8 IoCs

pid	Process
2824	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
2824	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
2712	Cilibi32.exe
2712	Cilibi32.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cacacg32.exe	Cilibi32.exe
File opened for modification	C:\Windows\SysWOW64\Cacacg32.exe	Cilibi32.exe
File created	C:\Windows\SysWOW64\Fdlpjk32.dll	Cilibi32.exe
File created	C:\Windows\SysWOW64\Cilibi32.exe	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
File opened for modification	C:\Windows\SysWOW64\Cilibi32.exe	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
File created	C:\Windows\SysWOW64\Hgpmbc32.dll	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2916	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cilibi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacacg32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cilibi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdlpjk32.dll"	Cilibi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cilibi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpmbc32.dll"	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2712	2824	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe	30
PID 2824 wrote to memory of 2712	2824	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe	30
PID 2824 wrote to memory of 2712	2824	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe	30
PID 2824 wrote to memory of 2712	2824	8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe	30
PID 2712 wrote to memory of 2916	2712	Cilibi32.exe	31
PID 2712 wrote to memory of 2916	2712	Cilibi32.exe	31
PID 2712 wrote to memory of 2916	2712	Cilibi32.exe	31
PID 2712 wrote to memory of 2916	2712	Cilibi32.exe	31
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32

C:\Users\Admin\AppData\Local\Temp\8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe
"C:\Users\Admin\AppData\Local\Temp\8e91a3096db341b746fa56a677eeca9f7f06f680bbe9ad026d1f57e8900bd501N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\Cilibi32.exe
  C:\Windows\system32\Cilibi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\Cacacg32.exe
    C:\Windows\system32\Cacacg32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 140
      4⤵
      Loads dropped DLL
      Program crash
      PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Cacacg32.exe

Filesize
96KB

MD5
0be425321d169acdbb09c4da1e0b1ee2

SHA1
aa19c5d3c78573401c59539993d40e16081f39ca

SHA256
fd0fe6b9b013dbea93418fdd82150accd76adcf027e0d39fbc680932fb7049ef

SHA512
b914df58690933dc0287595f99a0557e7f2d2c84132565303b3689c39ebe911d7f15ae67881a5f591b6ec0d75c98f99bf8fc6aa105af4aad3ef47987abb6bf7f

Download Submit
\Windows\SysWOW64\Cilibi32.exe

Filesize
96KB

MD5
b2ed4f1171f5ade180e5fb53837054ea

SHA1
11531b4b5498460fe644942bc67a77d359fa32d4

SHA256
e381897316058a23f2fb30187056eb4a00ba6ccee28ef8fb54ce69169d0cfd4a

SHA512
7b0c27ac5d776e7cdc396c19a1a0333586717eb79d827ef6b9b135bdcdec9d0fdb91e8330eec5efcc0844ca00e5b19e26d33f2b1b3da41e091d13199c1d80dc6

Download Submit
memory/2712-19-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2824-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2824-7-0x00000000003B0000-0x00000000003F1000-memory.dmp

Filesize
260KB

Download
memory/2824-12-0x00000000003B0000-0x00000000003F1000-memory.dmp

Filesize
260KB

Download
memory/2824-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-27-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads