Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 15:35
Static task
static1
Behavioral task
behavioral1
Sample
5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe
Resource
win10v2004-20241007-en
General
-
Target
5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe
-
Size
71KB
-
MD5
7614c91ea0b836b8291d9b6872604530
-
SHA1
ec2912cdde5e086304ea32cf369586f2c19f2ae4
-
SHA256
5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783
-
SHA512
a244b0dce0b6b074895545facde6094c8970908a404b1752f60c3474f2b0fb66f94abfbfe0fbd07575d8993e5c558bdbf44e307b790ba72250d8c4ebf22144dd
-
SSDEEP
1536:Qwfup/j+j4yEUZ8tGIkKxvFS1mrVKzYjkgUDDXrRQoDbEyRCRRRoR4Rk:QwWtjsElxvFlx4lXXre+Ey032ya
Malware Config
Extracted
berbew
http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cphndc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cphndc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbgjqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cbgjqo32.exe -
Berbew family
-
Executes dropped EXE 3 IoCs
pid Process 2908 Cphndc32.exe 2844 Cbgjqo32.exe 2160 Ceegmj32.exe -
Loads dropped DLL 10 IoCs
pid Process 2288 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe 2288 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe 2908 Cphndc32.exe 2908 Cphndc32.exe 2844 Cbgjqo32.exe 2844 Cbgjqo32.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\Cphndc32.exe 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe File created C:\Windows\SysWOW64\Lopdpdmj.dll 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe File created C:\Windows\SysWOW64\Llaemaih.dll Cphndc32.exe File opened for modification C:\Windows\SysWOW64\Ceegmj32.exe Cbgjqo32.exe File created C:\Windows\SysWOW64\Aoogfhfp.dll Cbgjqo32.exe File opened for modification C:\Windows\SysWOW64\Cphndc32.exe 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe File created C:\Windows\SysWOW64\Cbgjqo32.exe Cphndc32.exe File opened for modification C:\Windows\SysWOW64\Cbgjqo32.exe Cphndc32.exe File created C:\Windows\SysWOW64\Ceegmj32.exe Cbgjqo32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2860 2160 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cphndc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbgjqo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceegmj32.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llaemaih.dll" Cphndc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cphndc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lopdpdmj.dll" 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cphndc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cbgjqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoogfhfp.dll" Cbgjqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cbgjqo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2908 2288 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe 28 PID 2288 wrote to memory of 2908 2288 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe 28 PID 2288 wrote to memory of 2908 2288 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe 28 PID 2288 wrote to memory of 2908 2288 5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe 28 PID 2908 wrote to memory of 2844 2908 Cphndc32.exe 29 PID 2908 wrote to memory of 2844 2908 Cphndc32.exe 29 PID 2908 wrote to memory of 2844 2908 Cphndc32.exe 29 PID 2908 wrote to memory of 2844 2908 Cphndc32.exe 29 PID 2844 wrote to memory of 2160 2844 Cbgjqo32.exe 30 PID 2844 wrote to memory of 2160 2844 Cbgjqo32.exe 30 PID 2844 wrote to memory of 2160 2844 Cbgjqo32.exe 30 PID 2844 wrote to memory of 2160 2844 Cbgjqo32.exe 30 PID 2160 wrote to memory of 2860 2160 Ceegmj32.exe 31 PID 2160 wrote to memory of 2860 2160 Ceegmj32.exe 31 PID 2160 wrote to memory of 2860 2160 Ceegmj32.exe 31 PID 2160 wrote to memory of 2860 2160 Ceegmj32.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe"C:\Users\Admin\AppData\Local\Temp\5a4bac030ca5530722622657a9e0abb2aa1127f3aabb0855caf9324fa74c9783N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Cphndc32.exeC:\Windows\system32\Cphndc32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Cbgjqo32.exeC:\Windows\system32\Cbgjqo32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Ceegmj32.exeC:\Windows\system32\Ceegmj32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 1405⤵
- Loads dropped DLL
- Program crash
PID:2860
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5856c78c6198672edad4e6ade9cb37d1e
SHA10f7c908f954cdcf2228605b6fd059446e5f60d0c
SHA256bdbf0e5ef2a6f712a10cfe3beedae424e6206bcd52efc2fc244834c961ed7576
SHA5129573d4ff404a5256e08707e80e7940f931a27a9c82516db1a15a2ee8c79157ec5344b39b5ea091b0bbb42857cf76263c63b88e17aabb72bbbc26c9b3ad8f89de
-
Filesize
71KB
MD5779d49e51b944d0a6c92f6f66846bda2
SHA145d520e98f384847de73820af556cf60eff6742b
SHA25673e709b25a8c0372fa808a1625f563d3a68bef9440af5711f4b211d296ef791d
SHA5121da79707e7d81ae31fcfcb48da543188ccc7884192a2ed57cd48f954071bb58a7b3f1bbd5f961997642ba7ceeb616738e790c4ab6c53402cd4a743934431c337
-
Filesize
71KB
MD54ea70181f014c56befc9e4c9e691c243
SHA1bb7cd2002e13429bf3426fe012d0f8b617902668
SHA256a01af80595a2c17125d26bc91b0fc2167610bb7e575a5490c81e76fea85d0c90
SHA51207746113eecf23e8d366b7c1836693799f4168e98a57c7571bc70f2036212c4945ed70f9e864564229f1634a1fdec08130ca547399dc7013f3cd476ef9e0cf13