berbew | 4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1

General

Target

4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Size

144KB
MD5

3f06fb9cd729bf22caacf502e5247090
SHA1

a9654f308a35722e3c9e880d3c91672b61d4a403
SHA256

4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1
SHA512

4194ba453da8fca8ee7a3ce8630f03a2ff8b0a19ffcbb3614f2825c03c3fbb980bfec65f8a8728ca70c66fbd5dc52fade7c4ae8f215bd66c96af8bcd2e341b52
SSDEEP

3072:NYitxZ48zHtMQH2qC7ZQOlzSLUK6MwGsGnDc9nhVizLrId0:NYQe8zHtMQWfdQOhwJ6MwGsmLrId0

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjaonpnn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmpkjkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmpkjkma.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjaonpnn.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 3 IoCs

pid	Process
3056	Fjaonpnn.exe
2648	Fmpkjkma.exe
2616	Fkckeh32.exe

Loads dropped DLL 10 IoCs

pid	Process
1120	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
1120	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
3056	Fjaonpnn.exe
3056	Fjaonpnn.exe
2648	Fmpkjkma.exe
2648	Fmpkjkma.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fmpkjkma.exe	Fjaonpnn.exe
File created	C:\Windows\SysWOW64\Fkckeh32.exe	Fmpkjkma.exe
File created	C:\Windows\SysWOW64\Fjaonpnn.exe	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
File created	C:\Windows\SysWOW64\Hoogfn32.dll	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
File created	C:\Windows\SysWOW64\Fmpkjkma.exe	Fjaonpnn.exe
File created	C:\Windows\SysWOW64\Clkmne32.dll	Fmpkjkma.exe
File opened for modification	C:\Windows\SysWOW64\Fjaonpnn.exe	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
File created	C:\Windows\SysWOW64\Abofbl32.dll	Fjaonpnn.exe
File opened for modification	C:\Windows\SysWOW64\Fkckeh32.exe	Fmpkjkma.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2616	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkckeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjaonpnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmpkjkma.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmpkjkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmpkjkma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjaonpnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abofbl32.dll"	Fjaonpnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjaonpnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll"	Fmpkjkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoogfn32.dll"	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 3056	1120	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe	28
PID 1120 wrote to memory of 3056	1120	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe	28
PID 1120 wrote to memory of 3056	1120	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe	28
PID 1120 wrote to memory of 3056	1120	4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe	28
PID 3056 wrote to memory of 2648	3056	Fjaonpnn.exe	29
PID 3056 wrote to memory of 2648	3056	Fjaonpnn.exe	29
PID 3056 wrote to memory of 2648	3056	Fjaonpnn.exe	29
PID 3056 wrote to memory of 2648	3056	Fjaonpnn.exe	29
PID 2648 wrote to memory of 2616	2648	Fmpkjkma.exe	30
PID 2648 wrote to memory of 2616	2648	Fmpkjkma.exe	30
PID 2648 wrote to memory of 2616	2648	Fmpkjkma.exe	30
PID 2648 wrote to memory of 2616	2648	Fmpkjkma.exe	30
PID 2616 wrote to memory of 2500	2616	Fkckeh32.exe	31
PID 2616 wrote to memory of 2500	2616	Fkckeh32.exe	31
PID 2616 wrote to memory of 2500	2616	Fkckeh32.exe	31
PID 2616 wrote to memory of 2500	2616	Fkckeh32.exe	31

C:\Users\Admin\AppData\Local\Temp\4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe
"C:\Users\Admin\AppData\Local\Temp\4283ecd9cd203f8a1dfa4bbdfa921191504bc93ca35893a0d5e816cb08979bc1N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\Fjaonpnn.exe
  C:\Windows\system32\Fjaonpnn.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\Fmpkjkma.exe
    C:\Windows\system32\Fmpkjkma.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\Fkckeh32.exe
      C:\Windows\system32\Fkckeh32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 140
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fmpkjkma.exe

Filesize
144KB

MD5
061ec1828db0250a4abec8b9d25330fb

SHA1
a6635bd54bb37eb882e97a5db1bc8245ff7e47b1

SHA256
a1519388d8f066ec49348ac4c3447e8fada65476fe132dfe88fc0255e34c5f77

SHA512
92fa7ad11af462783a596676561916d62be64882aa26e187ea3ecdfb853645422e1a607c6048c27fe4a2a186a043eeacfa2c18ceb3cfc7fc55f9acfa8c6808a5

Download Submit
\Windows\SysWOW64\Fjaonpnn.exe

Filesize
144KB

MD5
f786b4e21e9d526d0070b1ed81c3e0ca

SHA1
4ff48b88760a62ca2cee7e85422e1ad88f4fee78

SHA256
251948f7c7070b4da2f3a3a36c12f4ab46c81fb3dd34ae06d1054df9e853564c

SHA512
5f63a010ad5aee67a569b04a79167980a1852dbacf25066095e81a1b25d8d0ee41e5f9620715d28e283e8bfcc2388e592f7ebb53dab35120d2e5c11eeea3c7aa

Download Submit
\Windows\SysWOW64\Fkckeh32.exe

Filesize
144KB

MD5
1288bed7cc45ec6494b99f7df3a24f87

SHA1
203b6b5eb87b7bfd726d87d51fa838056abd6041

SHA256
7088eafb5a59376760f786ed8e830f4569c7cfbb5f2936dfeac1892185ef575f

SHA512
1517f2a3b191cb33873c9809b720e6e6e381b4871a4991e5aa13f00dadfe95f098037b5a8454b5446aa519fcd9bb1c7f36e9a7fdfc3a2d89edbfe5d379c5ecc1

Download Submit
memory/1120-12-0x0000000000310000-0x0000000000351000-memory.dmp

Filesize
260KB

Download
memory/1120-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1120-44-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1120-45-0x0000000000310000-0x0000000000351000-memory.dmp

Filesize
260KB

Download
memory/2616-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-34-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/2648-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3056-18-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3056-46-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads