berbew | 0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ce

General

Target

0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Size

80KB
MD5

65781f570638b5236f3658fca7b923a0
SHA1

6b364da8f6041f2dcdb287f43ca4c8608e98af2c
SHA256

0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ce
SHA512

803b9f331c1c8e72eaa411e9eefa50233d664f70961a2286f213f0478ffbcebf66774a17ee91689f12c0d69cde8586797a2053f5a85fcc7653af7e0d38253ded
SSDEEP

1536:tLyYNZeeIc4iW7fmugzDfWqdMVrlEFtyb7IYOOqw4Tv:jNZeeIc4j7fmrzTWqAhELy1MTTv

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckiigmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckiigmcd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgechbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgechbh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 3 IoCs

pid	Process
2704	Ckiigmcd.exe
2088	Cmgechbh.exe
2692	Cacacg32.exe

Loads dropped DLL 10 IoCs

pid	Process
2792	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
2792	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
2704	Ckiigmcd.exe
2704	Ckiigmcd.exe
2088	Cmgechbh.exe
2088	Cmgechbh.exe
2244	WerFault.exe
2244	WerFault.exe
2244	WerFault.exe
2244	WerFault.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ckiigmcd.exe	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
File opened for modification	C:\Windows\SysWOW64\Cmgechbh.exe	Ckiigmcd.exe
File created	C:\Windows\SysWOW64\Gnnffg32.dll	Ckiigmcd.exe
File opened for modification	C:\Windows\SysWOW64\Cacacg32.exe	Cmgechbh.exe
File created	C:\Windows\SysWOW64\Fdlpjk32.dll	Cmgechbh.exe
File created	C:\Windows\SysWOW64\Ckiigmcd.exe	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
File created	C:\Windows\SysWOW64\Bjpdmqog.dll	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
File created	C:\Windows\SysWOW64\Cmgechbh.exe	Ckiigmcd.exe
File created	C:\Windows\SysWOW64\Cacacg32.exe	Cmgechbh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2692	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckiigmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgechbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacacg32.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnnffg32.dll"	Ckiigmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgechbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdlpjk32.dll"	Cmgechbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckiigmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckiigmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjpdmqog.dll"	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgechbh.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2704	2792	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe	30
PID 2792 wrote to memory of 2704	2792	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe	30
PID 2792 wrote to memory of 2704	2792	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe	30
PID 2792 wrote to memory of 2704	2792	0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe	30
PID 2704 wrote to memory of 2088	2704	Ckiigmcd.exe	31
PID 2704 wrote to memory of 2088	2704	Ckiigmcd.exe	31
PID 2704 wrote to memory of 2088	2704	Ckiigmcd.exe	31
PID 2704 wrote to memory of 2088	2704	Ckiigmcd.exe	31
PID 2088 wrote to memory of 2692	2088	Cmgechbh.exe	32
PID 2088 wrote to memory of 2692	2088	Cmgechbh.exe	32
PID 2088 wrote to memory of 2692	2088	Cmgechbh.exe	32
PID 2088 wrote to memory of 2692	2088	Cmgechbh.exe	32
PID 2692 wrote to memory of 2244	2692	Cacacg32.exe	33
PID 2692 wrote to memory of 2244	2692	Cacacg32.exe	33
PID 2692 wrote to memory of 2244	2692	Cacacg32.exe	33
PID 2692 wrote to memory of 2244	2692	Cacacg32.exe	33

C:\Users\Admin\AppData\Local\Temp\0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe
"C:\Users\Admin\AppData\Local\Temp\0716e86de06f6f03cb2dc6165d46cd616794247c03881aed0cf82f95aba145ceN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\Ckiigmcd.exe
  C:\Windows\system32\Ckiigmcd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\Cmgechbh.exe
    C:\Windows\system32\Cmgechbh.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\SysWOW64\Cacacg32.exe
      C:\Windows\system32\Cacacg32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 140
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ckiigmcd.exe

Filesize
80KB

MD5
c5bc9222af0856caebd8220a539ff116

SHA1
8c347fbf479292f9577a581b06ed1d0abf926767

SHA256
89c475c3a30fb693608a8c2e65cbceb5f7c260a7e859211112438d3b44e9a5e2

SHA512
d3678a1f6b03ce1e83e7d7519886fc0663426639e45fa3d4e3896737c25a3f3793d9222054810ab8e119bcca6d4693fd892d6636ed9651e7de2dd5bf780dd121

Download Submit
\Windows\SysWOW64\Cacacg32.exe

Filesize
80KB

MD5
8a788b9537592568ca4b25eac1abd85b

SHA1
b2aee367d34b2752a9a6cc3ec279e0f04b17d3aa

SHA256
d1919aae97ef017e98f6f3c8594dba6f6618b06871974587b8ca0fc39663c7cb

SHA512
9d4fa86a1b95657eb98574d3aa92f5cb328425ca35e4c7affff020f4728558ab068f4f1f05e74815a18788325b6bdb6f9620ea5fed36934c5b6c0793517ce92e

Download Submit
\Windows\SysWOW64\Cmgechbh.exe

Filesize
80KB

MD5
e7adab3307bfbc8cd600cd5d747fd8c3

SHA1
7537edbf66835e8717dcc497bce39913c85809a7

SHA256
822f31e158830a5224d50e551f37feac064580fd54d6058e6391fd2424552b34

SHA512
eef5c8ac889e3a035030efcea2ac8f0cf41c4d797eafa73de9baaa25119f79037f1b3528ce3ae829e8ac7bb063bc91a94a9c076576ae3c47444683b3d0b80979

Download Submit
memory/2088-27-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2088-35-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2088-46-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2692-41-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2704-26-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2792-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2792-18-0x00000000002E0000-0x0000000000315000-memory.dmp

Filesize
212KB

Download
memory/2792-17-0x00000000002E0000-0x0000000000315000-memory.dmp

Filesize
212KB

Download
memory/2792-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads