berbew | 1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9f

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Size 832KB
Sample241112-qvlf2stemd
SHA256 1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9f
MD5 ff83ea5135d262505e42396a90054d90
SHA1 4e53baf00dae67285484ec17ac24bc26d270a93e
SHA512 62f85b6850a0b61d735772a1e900d85a3da8b448e68ae038c8aa4d6ade5b30e7f65fbb1b9ae765fe001ae3bec35caf128922e6756c02929a9e122a3fb2c2a4d3
SSDEEP 6144:qKB7W19PQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKr2b:xB7WW/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 6 IoCs

pid	Process
4184	Cnnlaehj.exe
4112	Dfiafg32.exe
3632	Danecp32.exe
2760	Dodbbdbb.exe
4224	Dmjocp32.exe
1236	Dmllipeg.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dmjocp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	1236	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmjocp32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4184	1876	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe	83
PID 1876 wrote to memory of 4184	1876	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe	83
PID 1876 wrote to memory of 4184	1876	1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe	83
PID 4184 wrote to memory of 4112	4184	Cnnlaehj.exe	84
PID 4184 wrote to memory of 4112	4184	Cnnlaehj.exe	84
PID 4184 wrote to memory of 4112	4184	Cnnlaehj.exe	84
PID 4112 wrote to memory of 3632	4112	Dfiafg32.exe	85
PID 4112 wrote to memory of 3632	4112	Dfiafg32.exe	85
PID 4112 wrote to memory of 3632	4112	Dfiafg32.exe	85
PID 3632 wrote to memory of 2760	3632	Danecp32.exe	86
PID 3632 wrote to memory of 2760	3632	Danecp32.exe	86
PID 3632 wrote to memory of 2760	3632	Danecp32.exe	86
PID 2760 wrote to memory of 4224	2760	Dodbbdbb.exe	87
PID 2760 wrote to memory of 4224	2760	Dodbbdbb.exe	87
PID 2760 wrote to memory of 4224	2760	Dodbbdbb.exe	87
PID 4224 wrote to memory of 1236	4224	Dmjocp32.exe	88
PID 4224 wrote to memory of 1236	4224	Dmjocp32.exe	88
PID 4224 wrote to memory of 1236	4224	Dmjocp32.exe	88

C:\Users\Admin\AppData\Local\Temp\1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe
"C:\Users\Admin\AppData\Local\Temp\1200f1f56738943ed3a8452eaa1f48c38baf5d394600ca6335ab4dbd636a5a9fN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\Cnnlaehj.exe
  C:\Windows\system32\Cnnlaehj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\Dfiafg32.exe
    C:\Windows\system32\Dfiafg32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\SysWOW64\Danecp32.exe
      C:\Windows\system32\Danecp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2760
      - C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 396
        8⤵
        Program crash
        
        PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1236 -ip 1236
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cnnlaehj.exe

Path C:\Windows\SysWOW64\Cnnlaehj.exe
Size 832KB
SHA256 3a56ccc9a0789ff05848a31422c97ed38a3395ea6a0588a2bef3f796d483f547
MD5 33c00dd76dbd2bcf3d0e216fb00ce57e
SHA1 1d1c930578ff365e3d2a04e7fc22c00d972a6c32
SHA512 95595db3788c2a0512eabfcc02057af4c89c9fee4c12e814a471601be3edd78d4275f750eaba87d2becd7ea7dc98dc09e4b109cccc33ac392993dea8777d9077
SSDEEP 6144:D3SqY4GPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKr2b:zxYs/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Danecp32.exe

Path C:\Windows\SysWOW64\Danecp32.exe
Size 832KB
SHA256 495ad1d04a5621d43848e8b0fba7a0401c7c12a87e39028eccffc450a71664f6
MD5 adf2f7252ca6209dc072c6fd15db9c90
SHA1 c9203653411817fc48b9e1a4f9cb129d4872b454
SHA512 60d24cad02c2d681f8aebcc33626b6cc18e0b6972e5936de19016b5edb42178f44c3541fc37695e2752f9b34d1f95baed1184ff8b86c0512734bc08becb183cc
SSDEEP 6144:9DmdXNccPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKry:9DmdX8/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfiafg32.exe

Path C:\Windows\SysWOW64\Dfiafg32.exe
Size 832KB
SHA256 f3487e7031aab58c4024e3b7d6f611815b8921285179e1ee822da84a859b61ca
MD5 9413a9b332700bc83c79d6785bda1f4f
SHA1 95d7480a972fbfecb8e79f7e1b69d296fd7e9e81
SHA512 a66eebbed4fa6adefdf8d4fa47d78da30d221b775f7955dbdc0bcfa1fea7d4f58619453b081ed8e0d19b033826929fcb3eccb68159a7962a273d5b5cc646da96
SSDEEP 6144:zARYtiVPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKr2b:Yqp/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmjocp32.exe

Path C:\Windows\SysWOW64\Dmjocp32.exe
Size 832KB
SHA256 2995b3990a6f7c5c53016bdb5252f9a5851544c8da777fbcc4fc6daa53b3c963
MD5 c4034183ab5aea1a7371f98a091cbd5e
SHA1 741b323bfbd99a2a3264451cb18aea9f852a99a8
SHA512 e44fd8c939845e03c20fbad3ef4217a4db29d467bf58f2f0bfc63d59aee003b60ad1dc2682b917f5303dfa1e9f5d8e14c83b272b64ae87d6608a5fb5676c9a27
SSDEEP 6144:Tf+YTzyPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKr2b:T1P/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmllipeg.exe

Path C:\Windows\SysWOW64\Dmllipeg.exe
Size 832KB
SHA256 d16e4204b499a7394adbded2c60634ebdcc0af15964d17deac41fd61094dc6ac
MD5 d49114c919de3376f12a0a9734fbada5
SHA1 112d6a958a07a1060b8c5024a96b6c6ad6200b65
SHA512 5b3d378cc4a219ba53870d62d3e2f698f52d6584816ce461398361914f2fdaaea87de1734c5de63d864bd66499b033226ad12cc44374ef494821834b6414b296
SSDEEP 6144:jGJDz4BPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKr2b:jGJr/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dodbbdbb.exe

Path C:\Windows\SysWOW64\Dodbbdbb.exe
Size 832KB
SHA256 bd51366667a8b7d55c2ddba8cdccb745fbb6e9b847c8c3a3447f40ce7ec44ffe
MD5 c037e734d110087d3cc0cfcbefb6eb9d
SHA1 3f3d33cfd993ce968c70a9e17ddc22f25f75c29f
SHA512 ca32ca1c0ac05b5e8865ece4c239f12ad083b5d6ed29f0d08a37208f858da15f2ba5ea34e17475f04172dff08d93cc8295cc876cb9d769f4ef4dacd4b2c7e629
SSDEEP 6144:GdluC/vhA6Fl8NPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///1:GdcCnh7/Ng1/Nmr/Ng1/Nblt01PB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1236-52-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1236-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1876-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1876-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1876-63-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2760-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2760-55-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3632-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3632-57-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4112-59-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4112-17-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4184-61-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4184-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4224-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4224-53-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads