Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 12:13
Behavioral task
behavioral1
Sample
ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe
Resource
win10v2004-20241007-en
General
-
Target
ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe
-
Size
112KB
-
MD5
c2f3eca8928c77bf2144364acabdc8b3
-
SHA1
431d40c12d8739e769c0cb028d9b89ab971d8013
-
SHA256
dce975cb5f05325086081fdc6bbee667d5666bdcf0908fd86e7a14deabac6fc0
-
SHA512
4a0db837af40e158ec15208dc63e7f2aa1012651292feb323a7ee9c0d0fd8858974e81aa0966323c28e93f28efa82e75809b05c2d645ee3a357a22a5ee87d4d3
-
SSDEEP
1536:ObZ25k1X+Jv9aGW7nls7yxv1FDVRqC2LiJ9VqDlzVxyh+CbxMQguz6V34euullnn:ImtJvcffRqPiJ9IDlRxyhTbhgu+tAcrB
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkmmlgik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kageia32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Libjncnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Libjncnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkmmlgik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kageia32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgcnahoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgcnahoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfaalh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfaalh32.exe -
Berbew family
-
Executes dropped EXE 6 IoCs
pid Process 2688 Kfaalh32.exe 2652 Kkmmlgik.exe 2752 Kageia32.exe 2600 Kgcnahoo.exe 2624 Libjncnc.exe 2244 Lbjofi32.exe -
Loads dropped DLL 16 IoCs
pid Process 2640 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe 2640 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe 2688 Kfaalh32.exe 2688 Kfaalh32.exe 2652 Kkmmlgik.exe 2652 Kkmmlgik.exe 2752 Kageia32.exe 2752 Kageia32.exe 2600 Kgcnahoo.exe 2600 Kgcnahoo.exe 2624 Libjncnc.exe 2624 Libjncnc.exe 1584 WerFault.exe 1584 WerFault.exe 1584 WerFault.exe 1584 WerFault.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Kageia32.exe Kkmmlgik.exe File created C:\Windows\SysWOW64\Pgodelnq.dll Kageia32.exe File created C:\Windows\SysWOW64\Libjncnc.exe Kgcnahoo.exe File created C:\Windows\SysWOW64\Ipbkjl32.dll Kgcnahoo.exe File created C:\Windows\SysWOW64\Lbjofi32.exe Libjncnc.exe File opened for modification C:\Windows\SysWOW64\Kfaalh32.exe ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe File created C:\Windows\SysWOW64\Phblkn32.dll ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe File created C:\Windows\SysWOW64\Kkmmlgik.exe Kfaalh32.exe File opened for modification C:\Windows\SysWOW64\Kkmmlgik.exe Kfaalh32.exe File created C:\Windows\SysWOW64\Jlflfm32.dll Kkmmlgik.exe File opened for modification C:\Windows\SysWOW64\Lbjofi32.exe Libjncnc.exe File created C:\Windows\SysWOW64\Kfaalh32.exe ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe File created C:\Windows\SysWOW64\Onpeobjf.dll Kfaalh32.exe File created C:\Windows\SysWOW64\Kgcnahoo.exe Kageia32.exe File opened for modification C:\Windows\SysWOW64\Kgcnahoo.exe Kageia32.exe File opened for modification C:\Windows\SysWOW64\Libjncnc.exe Kgcnahoo.exe File created C:\Windows\SysWOW64\Kageia32.exe Kkmmlgik.exe File created C:\Windows\SysWOW64\Ipafocdg.dll Libjncnc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1584 2244 WerFault.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kageia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgcnahoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Libjncnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbjofi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfaalh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkmmlgik.exe -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kgcnahoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phblkn32.dll" ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfaalh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkmmlgik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kageia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kageia32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onpeobjf.dll" Kfaalh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgodelnq.dll" Kageia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbkjl32.dll" Kgcnahoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Libjncnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfaalh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlflfm32.dll" Kkmmlgik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kgcnahoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipafocdg.dll" Libjncnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Libjncnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkmmlgik.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2688 2640 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe 30 PID 2640 wrote to memory of 2688 2640 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe 30 PID 2640 wrote to memory of 2688 2640 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe 30 PID 2640 wrote to memory of 2688 2640 ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe 30 PID 2688 wrote to memory of 2652 2688 Kfaalh32.exe 31 PID 2688 wrote to memory of 2652 2688 Kfaalh32.exe 31 PID 2688 wrote to memory of 2652 2688 Kfaalh32.exe 31 PID 2688 wrote to memory of 2652 2688 Kfaalh32.exe 31 PID 2652 wrote to memory of 2752 2652 Kkmmlgik.exe 32 PID 2652 wrote to memory of 2752 2652 Kkmmlgik.exe 32 PID 2652 wrote to memory of 2752 2652 Kkmmlgik.exe 32 PID 2652 wrote to memory of 2752 2652 Kkmmlgik.exe 32 PID 2752 wrote to memory of 2600 2752 Kageia32.exe 33 PID 2752 wrote to memory of 2600 2752 Kageia32.exe 33 PID 2752 wrote to memory of 2600 2752 Kageia32.exe 33 PID 2752 wrote to memory of 2600 2752 Kageia32.exe 33 PID 2600 wrote to memory of 2624 2600 Kgcnahoo.exe 34 PID 2600 wrote to memory of 2624 2600 Kgcnahoo.exe 34 PID 2600 wrote to memory of 2624 2600 Kgcnahoo.exe 34 PID 2600 wrote to memory of 2624 2600 Kgcnahoo.exe 34 PID 2624 wrote to memory of 2244 2624 Libjncnc.exe 35 PID 2624 wrote to memory of 2244 2624 Libjncnc.exe 35 PID 2624 wrote to memory of 2244 2624 Libjncnc.exe 35 PID 2624 wrote to memory of 2244 2624 Libjncnc.exe 35 PID 2244 wrote to memory of 1584 2244 Lbjofi32.exe 36 PID 2244 wrote to memory of 1584 2244 Lbjofi32.exe 36 PID 2244 wrote to memory of 1584 2244 Lbjofi32.exe 36 PID 2244 wrote to memory of 1584 2244 Lbjofi32.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe"C:\Users\Admin\AppData\Local\Temp\ed2fec15c88461d3070fe94a420c538efe58af861d0199469a99295a5e6fdd66N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Kfaalh32.exeC:\Windows\system32\Kfaalh32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Kkmmlgik.exeC:\Windows\system32\Kkmmlgik.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\Kageia32.exeC:\Windows\system32\Kageia32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Kgcnahoo.exeC:\Windows\system32\Kgcnahoo.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Libjncnc.exeC:\Windows\system32\Libjncnc.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\Lbjofi32.exeC:\Windows\system32\Lbjofi32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1408⤵
- Loads dropped DLL
- Program crash
PID:1584
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD5ca51d71ae3687a18ef7b2ff8cb6bc616
SHA1da09acaf82ce5626890e1b7ad7e49247f47de65b
SHA256a85b8937e64aa51a19e97dfb7ba40a6935edaf4aef466c2fc04dd777bdc26e2f
SHA51211c82b00d2b387f9f4a95cf4943c610f446bc0110cebc45d8595fa21edf888022f75aa5439c7edd82080992cd4890658872e5d9a4977e7115832ce0e02c56705
-
Filesize
112KB
MD5da7e35bdb5784e52f90e94e67ebe4e23
SHA134d00206eaadee8aada35c766771a8ae7095e836
SHA256e178a997fe0ed4e39c7c29d7114a5499b924e6e3980f71b2d537af91d424b772
SHA512b085378dadb942977714184b6940daeaee4b25cef60a46a5648ddc24267a8af34b9cb825d7f32329f6943408cf815d427f9ebc72b98162f3f5eca0aad5e590ca
-
Filesize
112KB
MD5ffd565086989ebafdba506931567c42c
SHA1a064ff8c0c9568a592b5ae5a2548b6e1747239c9
SHA256216d54a1114e1a2495a066438918bad730a37545bcca54b676434e4c1c0d91d5
SHA51242251958dab319ffc8b1767b5f4ee048fbff045f2dac09e890b5c8cf997a0bdc292da9818d801c6e527861965bfb1a89561474ab75723eee7b21f1fb290ae537
-
Filesize
112KB
MD5342fea65081e12f79779788173489658
SHA1b644763bc8c6fc215044827d0238e65660160579
SHA256a43f85d1f913cc9fe4d08e8f383532064dab74deea62d18ffeb5203727cad7cc
SHA5128f5a711b08b18d9ce035fd03560003fae203a6d4d72a1dcac6b44567820fb7630a048b7db6230721ca4c15bfe76cca8f8108007471c751d1346b4c67946779af
-
Filesize
112KB
MD5793601d7d57706c6a655731706c37a49
SHA10b5c1ae65907729597b3c6b4e51db52b64812c9f
SHA2567049ff97b431a9ee8c3fe2cbc59be481df7d38e273e6905192da411f7d189b1c
SHA51273801890b91a3f1ed635f38019c107de3515aa1a21e5980b34303ae9781a0c08b35bb6a3cfd15cd3fe0f24be08c132851c5577114d85b1ade345538190c784a3
-
Filesize
112KB
MD5dc71da404d9f48ee6808f7786db742d9
SHA14103c678a718fa6829756689bcdc51ce561c6af2
SHA25604572a9c0f81f61a63930b7dd7b1dc1089327e84695fb2d20e7684bfeab5e5fa
SHA51209a283fbad721e8da6852dcb3718e766fd43c7d83350179b9f8c2582b3c53a06d0ef974496094a5312a56f95ad624179e668ac69f8083f061512717e6a9ad3ae