Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 15:46

General

  • Target

    cdb59d9dd3e571a2873a7ec86ec7d38a9fb1a3339da0f8dc2b07d508aa1d4ebaN.exe

  • Size

    576KB

  • MD5

    6c33d755e3bf197c5e0c1ee93135e940

  • SHA1

    8fee40c8bd579f199ee246f997b237d11c7531f4

  • SHA256

    cdb59d9dd3e571a2873a7ec86ec7d38a9fb1a3339da0f8dc2b07d508aa1d4eba

  • SHA512

    8b1d755a04ac8ec140aac102e137f8a20be750c45e66ed8cafb5fe2dcb33c407b98afca36e23d4c77cf5a1268f06305e6f840d4431127287e04b3f6eff2321ad

  • SSDEEP

    12288:jMuaTO2rJ8GyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSgRDO:jMuaa2riGyXsGG1ws5ipX6

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Berbew family
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 21 IoCs
  • Drops file in System32 directory 29 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 30 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdb59d9dd3e571a2873a7ec86ec7d38a9fb1a3339da0f8dc2b07d508aa1d4ebaN.exe
    "C:\Users\Admin\AppData\Local\Temp\cdb59d9dd3e571a2873a7ec86ec7d38a9fb1a3339da0f8dc2b07d508aa1d4ebaN.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\Bmlael32.exe
      C:\Windows\system32\Bmlael32.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\SysWOW64\Bqijljfd.exe
        C:\Windows\system32\Bqijljfd.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\SysWOW64\Bffbdadk.exe
          C:\Windows\system32\Bffbdadk.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\SysWOW64\Cbppnbhm.exe
            C:\Windows\system32\Cbppnbhm.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1200
            • C:\Windows\SysWOW64\Cmedlk32.exe
              C:\Windows\system32\Cmedlk32.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2560
              • C:\Windows\SysWOW64\Cbdiia32.exe
                C:\Windows\system32\Cbdiia32.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2616
                • C:\Windows\SysWOW64\Ckmnbg32.exe
                  C:\Windows\system32\Ckmnbg32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2976
                  • C:\Windows\SysWOW64\Cegoqlof.exe
                    C:\Windows\system32\Cegoqlof.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2268
                    • C:\Windows\SysWOW64\Dpapaj32.exe
                      C:\Windows\system32\Dpapaj32.exe
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2816
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 144
                        11⤵
                        • Loads dropped DLL
                        • Program crash
                        PID:1832

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\Bffbdadk.exe

          Filesize

          576KB

          MD5

          fdc69c2a43a82b3faba06a61b6f4dff7

          SHA1

          9bcad03740d3b562379ad92940a8f840c6b237bf

          SHA256

          412aabf8388739191331d7ac285310d263fca2a42b3e84c161fe04ccce929c9d

          SHA512

          c0e16f23dbe68322afecd4b08339eba728d2c1f3f74ab569ee2d680b28170c7c85e34a497797fb561b67545a6feede3b735f08c83657b68fd7f2fdef47c076df

        • C:\Windows\SysWOW64\Bqijljfd.exe

          Filesize

          576KB

          MD5

          06fdb5c2f44194a8728ba322ddd64007

          SHA1

          6802616266d1c6285eea2bc60429ed0ec9bf00c3

          SHA256

          863413cca5e1896dc5f92457274cda575636721f10cfe11bc88c763f86b69e75

          SHA512

          d9b35638117e4e0a4450a425454aca0a9fa792bd00500a65bed8708745d27e29af3b1e725256d1f1c566aed4868414a1dfded18615732ed0a421d2be42affca6

        • C:\Windows\SysWOW64\Ckmnbg32.exe

          Filesize

          576KB

          MD5

          7d729304d29c6117a9e48961d770d166

          SHA1

          454a88d944e8892a574d8463a81852adfcb27457

          SHA256

          3959ee6a973c5a4e08800175f84659eda97cffabd7114a5db20d4b4386dad005

          SHA512

          fee5d7be7a9f221c13bbba44959fd1e69043ee11c6a90d4076a7701f3d99c9aef5392c4787c8b64fa0271e5107cf4191a038f53714fca46fb786294a38c43290

        • C:\Windows\SysWOW64\Lmajfk32.dll

          Filesize

          7KB

          MD5

          d9ddde3d1badd1a466e5bb032a662fb5

          SHA1

          6e27b4c46e280601b2c7f0a568b627a212d4cf82

          SHA256

          d4ceeef82bbefd9b8f891f564552aa6cb488adeff2840bf02f4b81c353a3e7d0

          SHA512

          5f87b5319f81bb11a46b24bc48e012b76418bf1673bfa5e851e2fec77176903176edb8b4bca5c68c28f98878ac3ff2441b1b7d75e6782bea0a2dfb7d588c19bc

        • \Windows\SysWOW64\Bmlael32.exe

          Filesize

          576KB

          MD5

          7dc719d51a6d49712d04a170e6c4bbb8

          SHA1

          aa6e231500d877dd4c48db90e114d27eea3bd0a4

          SHA256

          83362171763869a2a2b95a1c9bfbd59607957e4017e5c9bdf0ff87f08cc0c9c8

          SHA512

          183a3829478d958ab04c2af812e5e4795a0e69ded73f85a679b6b039ffe19d69338a9446771fbf576845bb65cee3d8712fd562937d22aa7374b41a22f434d717

        • \Windows\SysWOW64\Cbdiia32.exe

          Filesize

          576KB

          MD5

          fd06e931512d9ac654fdc8101ab2dadf

          SHA1

          80ba2ba49b0586ebfce2707f9d605cef99d23d95

          SHA256

          9ef6a3a4e1515be61bd69e55156d1cb7670a5f2d9f0cac72d3c06dc4ef2413db

          SHA512

          e7fd3680a19cf2eeedfdac11afb9d236607a98204604aba563ddee1a0d59d22497bfca4e3de3ba50ed9daa78639dce96e54fe38877b4ab4589fb5eb83cdbef4c

        • \Windows\SysWOW64\Cbppnbhm.exe

          Filesize

          576KB

          MD5

          529a470250c9e55d157e96bbb6065a16

          SHA1

          8cb47d98da8b2aab9843f5b7ee38a3e334e5532a

          SHA256

          3983bd51a48cb88d7130404f0cfc65a2b32db9d415a4809891e048a1507bce3c

          SHA512

          2101acb33d12f424b3559c92e3fcafa13a34c23fdfb31641183bf20f48bbdc3581a95563148771cc0395e610b1f9394aa4f5e40410c768df46a73bb7ad9f3634

        • \Windows\SysWOW64\Cegoqlof.exe

          Filesize

          576KB

          MD5

          d43085524f8eebfb97414dd0393e61fb

          SHA1

          078e65e0a5892fa33aa0a6fbb25d1bce445f2ac3

          SHA256

          5043a94d8e4133a07e78280b52abe23608588008de3c9eee6f16d9e51f5c6bee

          SHA512

          c6fed8c8fd56af2e07c071189b8b3abb4e2b87224664e0b3179a87ab0049937d35c73450b3c680cae2857cfe570132236d684c0515087ee730a716f0ab0b8a99

        • \Windows\SysWOW64\Cmedlk32.exe

          Filesize

          576KB

          MD5

          b2222d9f2aba77b26577d75e36909930

          SHA1

          cff56d1a1c6e664c0e4e3cfe9e3d93d0c91f7c00

          SHA256

          d8d292b6ef31395256841af095fe28f907da6646b00b5808dc5b929681bf7cc5

          SHA512

          30f31db9e5f7877dc2cd5961be6eb8f95438d98b670a0ff748d292b57c3f9bf9e8f9145c3355ee39a07d57585c9fe8be216157bcf29d7a191e1855608cbe7898

        • \Windows\SysWOW64\Dpapaj32.exe

          Filesize

          576KB

          MD5

          2e7f1a1cd51e4e4da42ddbaa6a4e34b1

          SHA1

          8b9d1ade7b4cd8a4d35505d9a4cfcd9db7a2469b

          SHA256

          a19056d89f07bbe9c79ae23561e29fa8d40c52e5a434449d7221db7ca3968a76

          SHA512

          57cdeea5da553900e65c2e6252b96664fae41c13cd6e6c9d6b5dbf3575bb57348d470fde98957c1eb2c0022d60d1800baa8228f6fd940f6a8a98bc3631bccf40

        • memory/1200-68-0x00000000002D0000-0x0000000000304000-memory.dmp

          Filesize

          208KB

        • memory/1200-143-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/1200-63-0x00000000002D0000-0x0000000000304000-memory.dmp

          Filesize

          208KB

        • memory/2112-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2112-12-0x0000000000300000-0x0000000000334000-memory.dmp

          Filesize

          208KB

        • memory/2112-150-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2208-26-0x0000000000290000-0x00000000002C4000-memory.dmp

          Filesize

          208KB

        • memory/2208-13-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2208-148-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2208-27-0x0000000000290000-0x00000000002C4000-memory.dmp

          Filesize

          208KB

        • memory/2268-113-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-139-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-125-0x00000000002B0000-0x00000000002E4000-memory.dmp

          Filesize

          208KB

        • memory/2560-78-0x0000000000280000-0x00000000002B4000-memory.dmp

          Filesize

          208KB

        • memory/2560-142-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2560-70-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2616-97-0x0000000000250000-0x0000000000284000-memory.dmp

          Filesize

          208KB

        • memory/2616-98-0x0000000000250000-0x0000000000284000-memory.dmp

          Filesize

          208KB

        • memory/2616-138-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2616-84-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2792-28-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2792-41-0x0000000000280000-0x00000000002B4000-memory.dmp

          Filesize

          208KB

        • memory/2792-146-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2816-127-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2816-153-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2852-151-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2852-42-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2852-49-0x0000000000440000-0x0000000000474000-memory.dmp

          Filesize

          208KB

        • memory/2976-99-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2976-107-0x0000000000290000-0x00000000002C4000-memory.dmp

          Filesize

          208KB

        • memory/2976-137-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB