berbew | d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990

General

Target

d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Size

160KB
MD5

ebf171354d090a36a19c53591b7a6d50
SHA1

3e5abd63a5cb2abe8de76fdb7c8748b726492df1
SHA256

d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990
SHA512

c85027a412efd298356fedece0d1bf008eacfc18f31574848133b2b32796e578ebdef2cedf0ae96f628ff2f27874b8c6f77a3aeb0dddd0363b6177f630bddcf6
SSDEEP

3072:tjB04DabQyklgAxD8gb3a3+X13XRzrgHq/Wp+YmKfxgQdxvr:JB0s8M957aOl3BzrUmKyIxT

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckiigmcd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckiigmcd.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 2 IoCs

pid	Process
2712	Ckiigmcd.exe
2916	Cacacg32.exe

Loads dropped DLL 8 IoCs

pid	Process
2824	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
2824	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
2712	Ckiigmcd.exe
2712	Ckiigmcd.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ckiigmcd.exe	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
File created	C:\Windows\SysWOW64\Bjpdmqog.dll	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
File created	C:\Windows\SysWOW64\Cacacg32.exe	Ckiigmcd.exe
File opened for modification	C:\Windows\SysWOW64\Cacacg32.exe	Ckiigmcd.exe
File created	C:\Windows\SysWOW64\Fdlpjk32.dll	Ckiigmcd.exe
File created	C:\Windows\SysWOW64\Ckiigmcd.exe	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2916	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacacg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckiigmcd.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckiigmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckiigmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjpdmqog.dll"	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdlpjk32.dll"	Ckiigmcd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2712	2824	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe	30
PID 2824 wrote to memory of 2712	2824	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe	30
PID 2824 wrote to memory of 2712	2824	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe	30
PID 2824 wrote to memory of 2712	2824	d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe	30
PID 2712 wrote to memory of 2916	2712	Ckiigmcd.exe	31
PID 2712 wrote to memory of 2916	2712	Ckiigmcd.exe	31
PID 2712 wrote to memory of 2916	2712	Ckiigmcd.exe	31
PID 2712 wrote to memory of 2916	2712	Ckiigmcd.exe	31
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32
PID 2916 wrote to memory of 2748	2916	Cacacg32.exe	32

C:\Users\Admin\AppData\Local\Temp\d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe
"C:\Users\Admin\AppData\Local\Temp\d77b1cfbb6dc90482aa3a022c7099e0d585e57cde7195f896a5a87a685b6c990N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\Ckiigmcd.exe
  C:\Windows\system32\Ckiigmcd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\Cacacg32.exe
    C:\Windows\system32\Cacacg32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 140
      4⤵
      Loads dropped DLL
      Program crash
      PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cacacg32.exe

Filesize
160KB

MD5
826b851af7943b425a5b731e2b5cc46e

SHA1
90076c785382113693f3906b7d2d72a6882aa966

SHA256
43c07277ca56e30f44e0e74e487571419b8ac7379e15c6470879fe5d3fb0df7f

SHA512
b759735f3e41eb16b4324786ca6775c62f23b2b0ae1924721f97c2cee3935ebec03d70fb49ae366daa45d632e5c11319c9133cebe5241113ee3780f35aa9abd5

Download Submit
\Windows\SysWOW64\Ckiigmcd.exe

Filesize
160KB

MD5
3d9c424cb4fd38d81040b47ced510469

SHA1
ba6956898c74b8afe33e41c68bde021527455b9e

SHA256
010c25e370570c55c0b152cba9a4803055af6081ee01cc2d250a98521777b3e2

SHA512
69a5e106545d27f8efdaae6130a21034ced2cee35d02a88e2393861eb9f6c8e1b6c520437f5bb2567db04901e17e7e9f1caf6ac6b2183c05a2534ce7140574c3

Download Submit
memory/2712-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2824-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2824-6-0x0000000000450000-0x0000000000493000-memory.dmp

Filesize
268KB

Download
memory/2824-12-0x0000000000450000-0x0000000000493000-memory.dmp

Filesize
268KB

Download
memory/2824-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2916-27-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2916-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads