Analysis

  • max time kernel
    81s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 11:59

General

  • Target

    a1332a0636f37cef9dbc9df500138b5de351277f45195bee83743d9fd10ff8abN.exe

  • Size

    1.1MB

  • MD5

    c2739294e9b92637af3080190fd352b0

  • SHA1

    36ca507da1572a385b383f18759ecca431f67bd6

  • SHA256

    a1332a0636f37cef9dbc9df500138b5de351277f45195bee83743d9fd10ff8ab

  • SHA512

    97a1bb6af08daf1224fed5ff83763f4badbdb1b73a7eb3fcd7b24241f6431070a953ee6901052e825561484bd6cc6dabb817979a5bf59ebd60e04b58a4cbc6d3

  • SSDEEP

    12288:Yu/Ng1/Nmr/Ng1/Nblt01PBNkEoILCltC:YPlkcEpelk

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 10 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Berbew family
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Drops file in System32 directory 15 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 18 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1332a0636f37cef9dbc9df500138b5de351277f45195bee83743d9fd10ff8abN.exe
    "C:\Users\Admin\AppData\Local\Temp\a1332a0636f37cef9dbc9df500138b5de351277f45195bee83743d9fd10ff8abN.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\Llbconkd.exe
      C:\Windows\system32\Llbconkd.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\SysWOW64\Lghgmg32.exe
        C:\Windows\system32\Lghgmg32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\SysWOW64\Llepen32.exe
          C:\Windows\system32\Llepen32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\SysWOW64\Liipnb32.exe
            C:\Windows\system32\Liipnb32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2888
            • C:\Windows\SysWOW64\Lepaccmo.exe
              C:\Windows\system32\Lepaccmo.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2660
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 140
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2632

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\Lepaccmo.exe

          Filesize

          1.1MB

          MD5

          d6f832ff032154925fc7421b7fe37e03

          SHA1

          b0200c3c3da13b1f8fd304bed000de7989970b8c

          SHA256

          21ca72f43945988f4e1f8de33662ca9a80837106ea3a21003d8c52cb5e9312e4

          SHA512

          036f71971f7045259ec81c89385ddd4a1cc410c62671ac1fc47591a0416949332b51d3dc12bbd6a36f98e713694835991a5ed37e3f65ddd127d1bf56e2cee498

        • C:\Windows\SysWOW64\Lghgmg32.exe

          Filesize

          1.1MB

          MD5

          69e264453f8c38d6f34447e9531f18cf

          SHA1

          ffa06d87d7da43562b3b9b4eca389cf2c83bb420

          SHA256

          1aad5c7ab62920880b5ef7ec127bf70b0185847a41f1fbf323e025a9043845c2

          SHA512

          b720d0343b618c3f87de42abccb62bf7eee14fa37615f5ecf969b15c697c075215d45b4d3988accfceef551452e9416794ea23f3e68b7114dc58230e841ed803

        • \Windows\SysWOW64\Liipnb32.exe

          Filesize

          1.1MB

          MD5

          007dae0ab367d80ecc48f296144d28a4

          SHA1

          f6a8f4995b28d5ab5d6680a2aa0f9b9ba5c405fd

          SHA256

          282c13980fddbe3ffba32f2a36c216fb56db6f69ad1c30f9e6ddee580dee9f3a

          SHA512

          2ad6e5be663db472d2d7f77f9b81098bc8cced8b01373562c7702b43563b3b977b7ccf3bdc0fc5abf12f6863b8ce9f0c1f2e336de3172694aafb8062459de840

        • \Windows\SysWOW64\Llbconkd.exe

          Filesize

          1.1MB

          MD5

          58a8db1392a8cdd512ab9c59d953cdba

          SHA1

          3595fc3f76e3c86d6ab30fc8f8637007bca2ff14

          SHA256

          eed02f89489a719cf3cda33a51fc203db01fd24c9f326bd4a2f2c095a7666757

          SHA512

          485e831f71d974e10b39386b9cbd3a256be95dff5e847ff2b0170330f1312fc773573f96d6141ad24518411531dff2531e09aa1ad365f97c20f4ecd3c3fc73e8

        • \Windows\SysWOW64\Llepen32.exe

          Filesize

          1.1MB

          MD5

          43df2e7f4779d0aee4c75f97cbc03a9e

          SHA1

          7a1d69dab5c9f9ff71932c8afd49c82a00d0698d

          SHA256

          5759c89778e21d0bc3bf5d746c68c9d6863c8ed1e9786d3f3bded23e95b0de19

          SHA512

          ea49f34f46fc8966928bfe75eba7080b4bfa77cb1755f71100938d3a2792f1e49a18d5c2e2c0f61592daf00a834ed00c89203ead5a256377208fc904f8bc1e21

        • memory/1636-27-0x0000000000220000-0x0000000000254000-memory.dmp

          Filesize

          208KB

        • memory/1636-19-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/1636-22-0x0000000000220000-0x0000000000254000-memory.dmp

          Filesize

          208KB

        • memory/2660-80-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2716-50-0x0000000000220000-0x0000000000254000-memory.dmp

          Filesize

          208KB

        • memory/2716-55-0x0000000000220000-0x0000000000254000-memory.dmp

          Filesize

          208KB

        • memory/2716-84-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2756-36-0x0000000000220000-0x0000000000254000-memory.dmp

          Filesize

          208KB

        • memory/2756-85-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2756-41-0x0000000000220000-0x0000000000254000-memory.dmp

          Filesize

          208KB

        • memory/2888-64-0x00000000001B0000-0x00000000001E4000-memory.dmp

          Filesize

          208KB

        • memory/2888-69-0x00000000001B0000-0x00000000001E4000-memory.dmp

          Filesize

          208KB

        • memory/2888-78-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3040-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3040-12-0x00000000002A0000-0x00000000002D4000-memory.dmp

          Filesize

          208KB

        • memory/3040-11-0x00000000002A0000-0x00000000002D4000-memory.dmp

          Filesize

          208KB

        • memory/3040-82-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB