Analysis
-
max time kernel
32s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 03:32
Static task
static1
Behavioral task
behavioral1
Sample
604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe
Resource
win10v2004-20241007-en
General
-
Target
604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe
-
Size
55KB
-
MD5
d8c5f007acdf22c2eac98e64bddc63a0
-
SHA1
6942d8e420bf4d6e9d36cfd07584da844c984b78
-
SHA256
604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2
-
SHA512
a74152ef006af4f20bb83589734c78bf2c6e59f9ac9546b0fa8a582e312936f1642bf449958e4fc2a10c39c5e837c7fa4edc7499faf305a251b97f97ef509bbb
-
SSDEEP
768:k3XUbn311+UTzfmJ8mmwkMbPv4haXfeUBzY45gpZFKDhAsdwkwYIH2p/1H5GXdnh:iELWemJkfMbfnE8Lhlwlz2LO
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emnndlod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emnndlod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebjglbml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fidoim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebjglbml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fidoim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqgnokip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqgnokip.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecejkf32.exe -
Berbew family
-
Executes dropped EXE 6 IoCs
pid Process 2680 Eqgnokip.exe 2692 Ecejkf32.exe 2712 Emnndlod.exe 2688 Ebjglbml.exe 2616 Fidoim32.exe 3000 Fkckeh32.exe -
Loads dropped DLL 16 IoCs
pid Process 2432 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe 2432 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe 2680 Eqgnokip.exe 2680 Eqgnokip.exe 2692 Ecejkf32.exe 2692 Ecejkf32.exe 2712 Emnndlod.exe 2712 Emnndlod.exe 2688 Ebjglbml.exe 2688 Ebjglbml.exe 2616 Fidoim32.exe 2616 Fidoim32.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe 772 WerFault.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Eqgnokip.exe 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe File created C:\Windows\SysWOW64\Ecejkf32.exe Eqgnokip.exe File opened for modification C:\Windows\SysWOW64\Fidoim32.exe Ebjglbml.exe File created C:\Windows\SysWOW64\Dmkmmi32.dll Emnndlod.exe File opened for modification C:\Windows\SysWOW64\Fkckeh32.exe Fidoim32.exe File created C:\Windows\SysWOW64\Clkmne32.dll Fidoim32.exe File created C:\Windows\SysWOW64\Eqgnokip.exe 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe File created C:\Windows\SysWOW64\Jaqddb32.dll 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe File opened for modification C:\Windows\SysWOW64\Emnndlod.exe Ecejkf32.exe File created C:\Windows\SysWOW64\Bdacap32.dll Eqgnokip.exe File created C:\Windows\SysWOW64\Inegme32.dll Ecejkf32.exe File created C:\Windows\SysWOW64\Fkckeh32.exe Fidoim32.exe File opened for modification C:\Windows\SysWOW64\Ebjglbml.exe Emnndlod.exe File created C:\Windows\SysWOW64\Fidoim32.exe Ebjglbml.exe File created C:\Windows\SysWOW64\Khknah32.dll Ebjglbml.exe File opened for modification C:\Windows\SysWOW64\Ecejkf32.exe Eqgnokip.exe File created C:\Windows\SysWOW64\Emnndlod.exe Ecejkf32.exe File created C:\Windows\SysWOW64\Ebjglbml.exe Emnndlod.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 772 3000 WerFault.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebjglbml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fidoim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkckeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqgnokip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecejkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emnndlod.exe -
Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll" Fidoim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eqgnokip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaqddb32.dll" 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eqgnokip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inegme32.dll" Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khknah32.dll" Ebjglbml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebjglbml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fidoim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmkmmi32.dll" Emnndlod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emnndlod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdacap32.dll" Eqgnokip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emnndlod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebjglbml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fidoim32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2680 2432 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe 30 PID 2432 wrote to memory of 2680 2432 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe 30 PID 2432 wrote to memory of 2680 2432 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe 30 PID 2432 wrote to memory of 2680 2432 604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe 30 PID 2680 wrote to memory of 2692 2680 Eqgnokip.exe 31 PID 2680 wrote to memory of 2692 2680 Eqgnokip.exe 31 PID 2680 wrote to memory of 2692 2680 Eqgnokip.exe 31 PID 2680 wrote to memory of 2692 2680 Eqgnokip.exe 31 PID 2692 wrote to memory of 2712 2692 Ecejkf32.exe 32 PID 2692 wrote to memory of 2712 2692 Ecejkf32.exe 32 PID 2692 wrote to memory of 2712 2692 Ecejkf32.exe 32 PID 2692 wrote to memory of 2712 2692 Ecejkf32.exe 32 PID 2712 wrote to memory of 2688 2712 Emnndlod.exe 33 PID 2712 wrote to memory of 2688 2712 Emnndlod.exe 33 PID 2712 wrote to memory of 2688 2712 Emnndlod.exe 33 PID 2712 wrote to memory of 2688 2712 Emnndlod.exe 33 PID 2688 wrote to memory of 2616 2688 Ebjglbml.exe 34 PID 2688 wrote to memory of 2616 2688 Ebjglbml.exe 34 PID 2688 wrote to memory of 2616 2688 Ebjglbml.exe 34 PID 2688 wrote to memory of 2616 2688 Ebjglbml.exe 34 PID 2616 wrote to memory of 3000 2616 Fidoim32.exe 35 PID 2616 wrote to memory of 3000 2616 Fidoim32.exe 35 PID 2616 wrote to memory of 3000 2616 Fidoim32.exe 35 PID 2616 wrote to memory of 3000 2616 Fidoim32.exe 35 PID 3000 wrote to memory of 772 3000 Fkckeh32.exe 36 PID 3000 wrote to memory of 772 3000 Fkckeh32.exe 36 PID 3000 wrote to memory of 772 3000 Fkckeh32.exe 36 PID 3000 wrote to memory of 772 3000 Fkckeh32.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe"C:\Users\Admin\AppData\Local\Temp\604fab64dff393d0d546e64ca044f12479d27a5bf87e0a1687ff67df8e4c2df2N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Eqgnokip.exeC:\Windows\system32\Eqgnokip.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Ecejkf32.exeC:\Windows\system32\Ecejkf32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Emnndlod.exeC:\Windows\system32\Emnndlod.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Ebjglbml.exeC:\Windows\system32\Ebjglbml.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Fidoim32.exeC:\Windows\system32\Fidoim32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Fkckeh32.exeC:\Windows\system32\Fkckeh32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1408⤵
- Loads dropped DLL
- Program crash
PID:772
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5107dde67e9cc1d5a2ec0ed2e5d6e3f31
SHA17cbbc3f1c334e7eebad454124a4fca0aaf97e406
SHA256d8e164305c9cf63402c1d45c6202a8f1059e0e2a09be8959cc26bcb2adf4c1f0
SHA512fe678e3eb8283e777d4a163d3dd59c3365d400b1b139f62450e96cf25068a5f347b6e3b02e892a6c0d42884e293ce58de9ed31b073885dec7ec56e44b64179ab
-
Filesize
55KB
MD55ccedd12b0a5c9f62615fba9e91cf458
SHA1867d7cfaa54bf225fc8ab9ed4a1e61a55db67fd1
SHA2566480c738adfb961310422a86ae28b23d50d288850495f056140821443e497448
SHA5128d9c143a78156931a9da7575601b210914e8d5b509f8f39d3d33c152084381b194266ee50f1b13e52653f0686acdeb5f8b3014edaf8e721be1cd37278441802d
-
Filesize
55KB
MD59303f7d5f05f0555c2c4616ee6516fb8
SHA1230adb3aa3ad29e77cc684b1160fb891c82adc27
SHA25682dd9aaeea21b1094bce466964d8c05dfbbb53ccbbf263e0bb298690b789cbec
SHA512bb948450bd047f5b1734beebd11d0d7e291dd385b26673c2f94023fe762bee1f61eca380c35e94a8432aff9d4004bf093d75fcafbd33fc4656a05e935371ec38
-
Filesize
55KB
MD588292c9b827886bf8806145b330821a2
SHA177691830304f51346d2aae70828d4859262aa965
SHA25674d6d9a7ba43c42b3aae7ac7e2ae3080d93423aa615ed7fc5e99b68cc3e7c260
SHA5128d0860de501f2e356eed3261a7613b1e251c25db5cbfeffc797563610213446cc9b56deacae0b3b05561283cb92880eb801a87014e83f01ae9eb69a931727de3
-
Filesize
55KB
MD535adf687e9bb886ca92158647e8a9d64
SHA1ad36f93ba478e23f51fc1ee5ed0f96fef5f06ad2
SHA2565a052b88e13ea833b04e3bd7a03bd54b3399cd46a54aa27c8663105ea2e21fd0
SHA512d66f22f6f12d6d2b2ac263f7c2bab6c4df86433826a7199223235e6ff207c8816d3f66a4656f969955a111dce331410771a001a4dde0f8c7a1ae56b1f289e1cb
-
Filesize
55KB
MD514e1cb49f90c76068a156416530f617d
SHA10c5177b105bacf8f212bd9c1edd3ff79f359fe76
SHA25699c9bedf91ded7d3e221a9827d032af279c66906bee4350df8656c7fe762f0fd
SHA5127e7400aa2d91462d0add150ed6bc91a7430a958b634f038336e4553cd1f193986ca2ba26c61a96fd6cb3b2ca9f636abf1050d50ac0d2ecb4c40211d816332d54