Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 14:05

General

  • Target

    73a2dc714ab5711b13c47c50c665c0e2be9164781d92bd2f0671e650df82f432N.exe

  • Size

    359KB

  • MD5

    f1c5cbb315e68ea260431abbc9516210

  • SHA1

    7ff4e5a721ae856c4c6da7f516c6618fc00802f1

  • SHA256

    73a2dc714ab5711b13c47c50c665c0e2be9164781d92bd2f0671e650df82f432

  • SHA512

    59a435f7887604dae06cc1b581fe5eef4578e5a3279265890f4494ec66bbce8cb14391caf8067cb3290e594dec8f3c580788c25717ff849b62e6666fc169f0b3

  • SSDEEP

    3072:+Jyn4+7kbcSqJiCh0kQI8Va3CkfUVuyelbvP5lkzmQ1o0Otw44KmfpKivFM6Wpq5:+c17MchJiChprba4Yb31/doG

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 34 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Berbew family
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 38 IoCs
  • Drops file in System32 directory 51 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73a2dc714ab5711b13c47c50c665c0e2be9164781d92bd2f0671e650df82f432N.exe
    "C:\Users\Admin\AppData\Local\Temp\73a2dc714ab5711b13c47c50c665c0e2be9164781d92bd2f0671e650df82f432N.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\SysWOW64\Pdlkiepd.exe
      C:\Windows\system32\Pdlkiepd.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\SysWOW64\Poapfn32.exe
        C:\Windows\system32\Poapfn32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Windows\SysWOW64\Qqeicede.exe
          C:\Windows\system32\Qqeicede.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2648
          • C:\Windows\SysWOW64\Aeenochi.exe
            C:\Windows\system32\Aeenochi.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2304
            • C:\Windows\SysWOW64\Afgkfl32.exe
              C:\Windows\system32\Afgkfl32.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:296
              • C:\Windows\SysWOW64\Abphal32.exe
                C:\Windows\system32\Abphal32.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1780
                • C:\Windows\SysWOW64\Afnagk32.exe
                  C:\Windows\system32\Afnagk32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1992
                  • C:\Windows\SysWOW64\Bhajdblk.exe
                    C:\Windows\system32\Bhajdblk.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1332
                    • C:\Windows\SysWOW64\Bnkbam32.exe
                      C:\Windows\system32\Bnkbam32.exe
                      10⤵
                      • Adds autorun key to be loaded by Explorer.exe on startup
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2948
                      • C:\Windows\SysWOW64\Bonoflae.exe
                        C:\Windows\system32\Bonoflae.exe
                        11⤵
                        • Adds autorun key to be loaded by Explorer.exe on startup
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:1856
                        • C:\Windows\SysWOW64\Balkchpi.exe
                          C:\Windows\system32\Balkchpi.exe
                          12⤵
                          • Adds autorun key to be loaded by Explorer.exe on startup
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:2088
                          • C:\Windows\SysWOW64\Blaopqpo.exe
                            C:\Windows\system32\Blaopqpo.exe
                            13⤵
                            • Adds autorun key to be loaded by Explorer.exe on startup
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:1800
                            • C:\Windows\SysWOW64\Baohhgnf.exe
                              C:\Windows\system32\Baohhgnf.exe
                              14⤵
                              • Adds autorun key to be loaded by Explorer.exe on startup
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2188
                              • C:\Windows\SysWOW64\Bfkpqn32.exe
                                C:\Windows\system32\Bfkpqn32.exe
                                15⤵
                                • Adds autorun key to be loaded by Explorer.exe on startup
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:1360
                                • C:\Windows\SysWOW64\Baadng32.exe
                                  C:\Windows\system32\Baadng32.exe
                                  16⤵
                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:1260
                                  • C:\Windows\SysWOW64\Cfnmfn32.exe
                                    C:\Windows\system32\Cfnmfn32.exe
                                    17⤵
                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    PID:1244
                                    • C:\Windows\SysWOW64\Cacacg32.exe
                                      C:\Windows\system32\Cacacg32.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:3044
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 140
                                        19⤵
                                        • Loads dropped DLL
                                        • Program crash
                                        PID:1372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Abphal32.exe

    Filesize

    359KB

    MD5

    85fa99e612cd731e73e126b6f435e969

    SHA1

    da3ef2b3a12a3ca077ffd65156ea47679057bf5c

    SHA256

    9f66b1e50a1d4403ec8ff4b3ba21b80cc2df53a31fc0610edf649156d7c4fd9d

    SHA512

    930b8731341b26f7da3b068c1974674db4f6462406a49177d384fc3632ddaab45ab06c38873a2fcea1f1e91b3e73927a46c78158381b2273e61915152a73117e

  • C:\Windows\SysWOW64\Aeenochi.exe

    Filesize

    359KB

    MD5

    42f957b963828eef1007b712bf3bd85f

    SHA1

    36effa0f4ef9f9bc7dcc467543da1ce2ace7a355

    SHA256

    cd4a4261f419ed39c5e59c23c7d65026f86dca3bead0f714ef0b87c6cb25e481

    SHA512

    848cf792263b4a18936fe82c4d79c45930ffb84de9d71e8e70cae4c39d204a636a238873615dc45a393f9bca5fb02c9df9aad971619ecb4bb856a6bfc8703186

  • C:\Windows\SysWOW64\Baadng32.exe

    Filesize

    359KB

    MD5

    16f834e7153e216c934745122d63c7d7

    SHA1

    dff95b896923f2a681328853924639ecaa214566

    SHA256

    48b07200246bc72108614fa89310d650ad83274870e3f269f3b77fe46969f98d

    SHA512

    62a9ae1275af534ec88a7feac2b073458d2ba1ee0a63dad6e5b576d7982ae10a3e2885701e419982ec9039d9678d7f62491824a0a731604e533a8d921fb41db7

  • C:\Windows\SysWOW64\Balkchpi.exe

    Filesize

    359KB

    MD5

    48fefc482ea4081b31a8fc8e82f7cce7

    SHA1

    f6cb79b672fe56c9bde2ab27d8c959cf19d52fc3

    SHA256

    6b30979901a7d16e2ce49f0fdca8b73a8448386a17df84368c88ffd61e99f0ed

    SHA512

    11c888968565b94aebf0201b81cefe4ad8c979f0d740028c23d692df77e5950550b7cfab1c2b2aea8a3225fad4c0f058977dec86503459922f5cbaa5506b8007

  • C:\Windows\SysWOW64\Baohhgnf.exe

    Filesize

    359KB

    MD5

    fe71466fa345845f625ca12fc0b7164f

    SHA1

    89282b95a03d719bdebcfd9799ce2eff0e3c09f2

    SHA256

    4c2cd5e8ba76dcc663411a9e60aa22f24e6a40d420bac149cabb37d92b1221ee

    SHA512

    94b69b1f757143cd7d55e090143cdb358a62fa79472e813e6dd3bb6fa1088e89b453ca9216bbfe3f30648fd1bc35ada4d21f293846df612a769759b48a6c757e

  • C:\Windows\SysWOW64\Bfkpqn32.exe

    Filesize

    359KB

    MD5

    5947f24fb8a41a7f35b67cffb93b9eab

    SHA1

    555edfc1cd0c1044268326c50c16a93c550f8c79

    SHA256

    d7b6c1857b3929345a0e6fe22593e470f7cb8459e8c15fcbc0dfe6cbfabd73d4

    SHA512

    5cd069075510c832b27e66eb8f1cf039e43fe90b512ed28e0c4640946d35ef53f952a29584f49fd7eb120e5ed1b3ba41b7286dfa53600de6e771610b13053643

  • C:\Windows\SysWOW64\Bonoflae.exe

    Filesize

    359KB

    MD5

    4086f90cc6d4b89b02ce261b3637f9fc

    SHA1

    9b6f2c3f5d2b6fd622ee83b86226d7615e0171da

    SHA256

    82228aeab0de9714116efed47cc21f74d527ab1be40450e541537fcddb3196f1

    SHA512

    45d0005a7596af52c8e7d5d6c428792977497d2e83fb02939f999bbcb70e2246e48445b04039abf172b008ba733261a62ea81ba9362d2f89c959c01512a33aca

  • C:\Windows\SysWOW64\Cacacg32.exe

    Filesize

    359KB

    MD5

    e027dc1772b997058a2fc994509bd923

    SHA1

    6285428eb5f8773da76f9234db85be8b494bb135

    SHA256

    8c12ea58e568056165f91a3a8f9de3b239098d017ca488a848fd8adb9476bfc0

    SHA512

    f6b476194ada1d9f7c27f5962a91f756ff26888188296bb32120f805d2bc081830d4d48363ae747e64eb5499411c46db0bd72fb7ca349dab9cab43372ba5dbd2

  • C:\Windows\SysWOW64\Cfnmfn32.exe

    Filesize

    359KB

    MD5

    901b77df757314b9a50f2b3210a1086f

    SHA1

    71f3014b5c31ee25690c2d6d406264a7202ca13e

    SHA256

    c82ec78d8b5d899ff23f02c162a3483ba05246a6a8bd12928f8b72d26b1b651c

    SHA512

    bfd594d83e76b1c39326b0563b158ad893ce85c72dc1be096eaa068414fe11f94dbfd10ac86ce99af73889241ba93b34d37f44e2a5f8f7388babcb2f0c286c7d

  • \Windows\SysWOW64\Afgkfl32.exe

    Filesize

    359KB

    MD5

    eeb54dab3b7ed50f05069d9d77ea6aac

    SHA1

    cd3ff0387df32cc42000ff9eb10f4410cb04e76c

    SHA256

    c5125add32e298deea7b9346a5f7bb91f5ede70fbf2764ed9fe6dbc32a35b3b4

    SHA512

    931d0c5abd59129572ea8f4d80a7b46fd622c94a8e245501c8f98e7e0237335d06d15daab1edc066d0a668c5b47f1eba69f06a2d5b90a94f8be81d6bf07fac20

  • \Windows\SysWOW64\Afnagk32.exe

    Filesize

    359KB

    MD5

    16f6c1b597e527cf060557e5c55d5a5a

    SHA1

    b54c2789d56e1754617cff6c80f6ea538176a651

    SHA256

    dc8d129396595a3e19816317699d09bbc208697776734f006ae5f4ba8cc705f7

    SHA512

    fcbd289da0ad98d79833b82eefa1ac371bb890a1f674eca6359ca994e03214326eb6961fdea5367bad0466f21e3a5388770959ca90929e2954b47cc193226efe

  • \Windows\SysWOW64\Bhajdblk.exe

    Filesize

    359KB

    MD5

    eb32ebdf6156c8153b10ecff34e7118a

    SHA1

    56df6f93483dd11aea9b2a53f762356295fe9319

    SHA256

    e7846cf3cf621cc531213fa20054cb2fec5c77de33ff3bb83cd5afa300ad2c1f

    SHA512

    0999bf29d3b5d40d860e920df35a93571480a14c57d7f9de5da05923a3c1c7f72a9d8887992747b14afa07b92a0e64f30b30b9b3f94733715410776cf1010ea1

  • \Windows\SysWOW64\Blaopqpo.exe

    Filesize

    359KB

    MD5

    0eeea682e748b13b2e6be0744ae98959

    SHA1

    6ec16322e02369e12c1e2070c22acd4f47c56436

    SHA256

    af3ba10214d65a2ee3498838f64c0a2216088997b756530a29ea0c06ecb219f7

    SHA512

    b3fd53078651cdad04913e56b60df4f4b2077c0d40f393ee0c509951d9fecc994c29200fbc68dac49844bbe550b856182ae22cdd33dfbf69547f028f255e996f

  • \Windows\SysWOW64\Bnkbam32.exe

    Filesize

    359KB

    MD5

    baa7f941a906f8fc152c64cb882c2742

    SHA1

    51a9956ac130fd5d866d617b1f26a55809ed551d

    SHA256

    fb2749f4f2dcacaaf046e8e63b74ea7609a2886663c442e8109002b75685e2fb

    SHA512

    61a4b7278dd0625c688aba4a897be6ecc3b9b05594b86ccc6adfb259abc8944c03e2c69700ab59c4ea57c3bfbc0aeb402496c8429ab7d3de39047d8c28517b51

  • \Windows\SysWOW64\Pdlkiepd.exe

    Filesize

    359KB

    MD5

    23c2a40c28fef866c4b05688e33b70f6

    SHA1

    04109970ead9fec5cca389294429d8a2f1a1f981

    SHA256

    1f2b44501cf54f69481cd1e1efef12c4f6eb799cf0d351869c0d881f4b2e3e9f

    SHA512

    8a1d9a6fc1b6316063e2b9a8fc9a57bc2dcf7f40d5f19733fcaa6c57e4a103e7a53377ebaaa6bcb36b7cc7af7d4cb44f806979dbb21f24f9418b0d211c149c59

  • \Windows\SysWOW64\Poapfn32.exe

    Filesize

    359KB

    MD5

    ee2de353c999af9d9f69b28b609eef6f

    SHA1

    cc30d00d9806e0c1dbffd860afd7da054ca0130d

    SHA256

    753776a017ff3150cbebe42f271b538bfbed1a0c3511cf73c4bbaf105bd66303

    SHA512

    a02f03ffd80bc7e58e641116e612ceb80454b913643b3c61c7171afa667319d00ed6c26798597ca1c7d8b93f0909f88ca4befcf571f46f64239789144d2faf07

  • \Windows\SysWOW64\Qqeicede.exe

    Filesize

    359KB

    MD5

    6f469be3946a529a53c375d7b92c85a6

    SHA1

    7e75ad5dc1f761a1ad38e521169f4f63ca0eb176

    SHA256

    5f8a86972880d94db50ceb041d9e4c68cfc9196ed42df09dcf0a6c1afc9c1ebf

    SHA512

    23526735ac4053d85f02727a21f9e43e86e1775820c823113d39ad40b06edd375627ecdb8517016fc5742f8719cbff6f325b18255b254e0fd5730a7a42692d3d

  • memory/296-239-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/296-70-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/296-77-0x0000000000260000-0x0000000000293000-memory.dmp

    Filesize

    204KB

  • memory/1244-225-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1260-224-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1332-216-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1332-235-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1332-217-0x00000000002F0000-0x0000000000323000-memory.dmp

    Filesize

    204KB

  • memory/1360-223-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1780-96-0x0000000000310000-0x0000000000343000-memory.dmp

    Filesize

    204KB

  • memory/1780-237-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1800-221-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1856-219-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1992-97-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1992-236-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1992-110-0x0000000001F40000-0x0000000001F73000-memory.dmp

    Filesize

    204KB

  • memory/2088-220-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2188-222-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2304-56-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2304-64-0x0000000000440000-0x0000000000473000-memory.dmp

    Filesize

    204KB

  • memory/2304-244-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2636-28-0x0000000000250000-0x0000000000283000-memory.dmp

    Filesize

    204KB

  • memory/2636-242-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2636-22-0x0000000000250000-0x0000000000283000-memory.dmp

    Filesize

    204KB

  • memory/2636-14-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2648-241-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2648-43-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2652-31-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2652-238-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2652-41-0x0000000000270000-0x00000000002A3000-memory.dmp

    Filesize

    204KB

  • memory/2876-11-0x0000000000250000-0x0000000000283000-memory.dmp

    Filesize

    204KB

  • memory/2876-0-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2876-12-0x0000000000250000-0x0000000000283000-memory.dmp

    Filesize

    204KB

  • memory/2876-234-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2948-218-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3044-226-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB