Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 04:04
Behavioral task
behavioral1
Sample
39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe
Resource
win10v2004-20241007-en
General
-
Target
39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe
-
Size
145KB
-
MD5
e79110365ed2b9a4726a221a04aa9070
-
SHA1
1c91f94f29ea552122a59ab4877ee73a492b7455
-
SHA256
39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5
-
SHA512
1844b40ca5421220851812c6771c1501641bbe2c3949d16a10f68a5db2e2bdc822c1acd60726fa295a9a00cf5113b2e61152c2782e495d45f9b3bbffc563fb65
-
SSDEEP
3072:4dAZics2UvSmNhXAKRGKk6o4hfi12CIeoimEzRWbNmog:4iMxhXJRG/6o4eTRMg
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oomlfpdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oomlfpdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opmhqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Opmhqc32.exe -
Berbew family
-
Executes dropped EXE 3 IoCs
pid Process 1724 Oomlfpdi.exe 2348 Opmhqc32.exe 2964 Ockdmn32.exe -
Loads dropped DLL 10 IoCs
pid Process 2300 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe 2300 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe 1724 Oomlfpdi.exe 1724 Oomlfpdi.exe 2348 Opmhqc32.exe 2348 Opmhqc32.exe 580 WerFault.exe 580 WerFault.exe 580 WerFault.exe 580 WerFault.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mfdfng32.dll 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe File opened for modification C:\Windows\SysWOW64\Opmhqc32.exe Oomlfpdi.exe File created C:\Windows\SysWOW64\Cdhbbpkh.dll Oomlfpdi.exe File created C:\Windows\SysWOW64\Khhaomjd.dll Opmhqc32.exe File created C:\Windows\SysWOW64\Oomlfpdi.exe 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe File created C:\Windows\SysWOW64\Opmhqc32.exe Oomlfpdi.exe File created C:\Windows\SysWOW64\Ockdmn32.exe Opmhqc32.exe File opened for modification C:\Windows\SysWOW64\Ockdmn32.exe Opmhqc32.exe File opened for modification C:\Windows\SysWOW64\Oomlfpdi.exe 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 580 2964 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ockdmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oomlfpdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opmhqc32.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Opmhqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khhaomjd.dll" Opmhqc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oomlfpdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfdfng32.dll" 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdhbbpkh.dll" Oomlfpdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oomlfpdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Opmhqc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1724 2300 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe 30 PID 2300 wrote to memory of 1724 2300 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe 30 PID 2300 wrote to memory of 1724 2300 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe 30 PID 2300 wrote to memory of 1724 2300 39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe 30 PID 1724 wrote to memory of 2348 1724 Oomlfpdi.exe 31 PID 1724 wrote to memory of 2348 1724 Oomlfpdi.exe 31 PID 1724 wrote to memory of 2348 1724 Oomlfpdi.exe 31 PID 1724 wrote to memory of 2348 1724 Oomlfpdi.exe 31 PID 2348 wrote to memory of 2964 2348 Opmhqc32.exe 32 PID 2348 wrote to memory of 2964 2348 Opmhqc32.exe 32 PID 2348 wrote to memory of 2964 2348 Opmhqc32.exe 32 PID 2348 wrote to memory of 2964 2348 Opmhqc32.exe 32 PID 2964 wrote to memory of 580 2964 Ockdmn32.exe 33 PID 2964 wrote to memory of 580 2964 Ockdmn32.exe 33 PID 2964 wrote to memory of 580 2964 Ockdmn32.exe 33 PID 2964 wrote to memory of 580 2964 Ockdmn32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe"C:\Users\Admin\AppData\Local\Temp\39268f8d9095cfca545ed2d2e9d55dabfba4a5eca2e12867840ee3523b285fe5N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Oomlfpdi.exeC:\Windows\system32\Oomlfpdi.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\Opmhqc32.exeC:\Windows\system32\Opmhqc32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\Ockdmn32.exeC:\Windows\system32\Ockdmn32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1405⤵
- Loads dropped DLL
- Program crash
PID:580
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD58fcfc24a1da9dbf0d4b58d6578dcf748
SHA1a31d2f3c6d9d8410f18bd3808cfdc5732c514a4d
SHA256ce30308a39d8e573fc7af9cd6f0ec45c9795d5a95dce28436424c7b5a6b0a457
SHA51270d200d55fa464238a42c7925b27da643a6a14ac489c4965eec53cf78468f0b9511f8a58c63d3f8c0d6b829042c867a51e6945d6f7e272a273a9ac76ddf47df7
-
Filesize
145KB
MD5c5eea070c5e2f015d04ad76395d2a8db
SHA1fcbc8fdb789b085a1ba94a17b0a3c976b2ec2813
SHA2562a66c44e6cbc52b1a8a4f366a700659cf79061f94dc0b07df637525701076503
SHA5127361e9fe756d8e44a16b159e590822f09d64440dbbd0e23a43e24051b18412f7ac3da5ebd0ddbdf7e97ca4f27857314db3c729c4f43e798dac5b4b7863243ab8
-
Filesize
145KB
MD58a348f0fa15b6511833f6f42a66a1a4e
SHA1c62369abb9a8ba366fc09eb9aeb89fcd54231c97
SHA2565bf475e69ee26405e0c4167e941a1060d74d99f9fd847ebef54907c69096b65f
SHA512b840dc9f6495fc5394134fcc33db9fb0488aeaac0175dd806bc6221802bc03c7e1ee524a1c0ebea023f919e9839b4696289080a2526cb74a0a3cd8694346c9ba