Overview

overview

10

Static

static

3

794dcac725...eN.exe

windows7-x64

10

794dcac725...eN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    794dcac7258e88b382b78832b853fd6060a312bf4b01e4ac613c7f6782225e3eN

  • Size

    96KB

  • Sample

    240930-npcwlsxdke

  • MD5

    3b493b14ed05f438f747e01436e42760

  • SHA1

    cefea8ed9eff6e3f3e88d7a51e89e6a2dd8e49e7

  • SHA256

    794dcac7258e88b382b78832b853fd6060a312bf4b01e4ac613c7f6782225e3e

  • SHA512

    9ffc2cc4fb0d9f7e96d9307c706933736457b33e37de58e166ac14a4b4e5c290bb5128dea86791ec6baa5f6b2c5b2d398fcfc47e8d2ae466e9e1c364bf6f7e42

  • SSDEEP

    1536:akupAAm/YrUfBLv1RxwuGehcZ8Dvr6s7OzfPZDjSE2ty74S7V+5pUMv84WMRw8DO:rupbmAId1RnGeKorn7sfxDjSEia4Sp+s

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      794dcac7258e88b382b78832b853fd6060a312bf4b01e4ac613c7f6782225e3eN

    • Size

      96KB

    • MD5

      3b493b14ed05f438f747e01436e42760

    • SHA1

      cefea8ed9eff6e3f3e88d7a51e89e6a2dd8e49e7

    • SHA256

      794dcac7258e88b382b78832b853fd6060a312bf4b01e4ac613c7f6782225e3e

    • SHA512

      9ffc2cc4fb0d9f7e96d9307c706933736457b33e37de58e166ac14a4b4e5c290bb5128dea86791ec6baa5f6b2c5b2d398fcfc47e8d2ae466e9e1c364bf6f7e42

    • SSDEEP

      1536:akupAAm/YrUfBLv1RxwuGehcZ8Dvr6s7OzfPZDjSE2ty74S7V+5pUMv84WMRw8DO:rupbmAId1RnGeKorn7sfxDjSEia4Sp+s

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks