berbew | ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f

General

Target

ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Size

69KB
MD5

f08208772c681a333987889a7d8c9df7
SHA1

d02e2f080b9a7fd5ecb3dc9c090233d1535afd9b
SHA256

ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f
SHA512

5792e3fb889fff441eae78f1637e5e9036a05c1f96ab146607402858ceedfbb7cfb6d3f8ab49300eb640f3bd20406663765543207aba5fffebd918f630b58155
SSDEEP

768:N251V1a0PQFWkVNcrFB8phzBkyevyfuWffEBAgn9NIP/1H58VU9UiEb/KEiEixVR:s5hayJ88B7X7xMhbPgUN3QivEg

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exeDanpemej.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danpemej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danpemej.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Executes dropped EXE 2 IoCs

Processes:

Danpemej.exeDpapaj32.exe

pid process

2844 Danpemej.exe
1040 Dpapaj32.exe

pid	process
2844	Danpemej.exe
1040	Dpapaj32.exe

Loads dropped DLL 7 IoCs

Processes:

ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exeDanpemej.exeWerFault.exe

pid	process
2148	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
2148	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
2844	Danpemej.exe
2844	Danpemej.exe
2920	WerFault.exe
2920	WerFault.exe
2920	WerFault.exe

Drops file in System32 directory 6 IoCs

Processes:

Danpemej.exeea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Danpemej.exe
File created	C:\Windows\SysWOW64\Danpemej.exe	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
File opened for modification	C:\Windows\SysWOW64\Danpemej.exe	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
File created	C:\Windows\SysWOW64\Cbehjc32.dll	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Danpemej.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Danpemej.exe

Drops file in Windows directory 2 IoCs

Processes:

Dpapaj32.exe

description	ioc	process
File created	C:\Windows\system32†Dfkhndca.¿xe	Dpapaj32.exe
File opened for modification	C:\Windows\system32†Dfkhndca.¿xe	Dpapaj32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2920 1040 WerFault.exe

pid	pid_target	process
2920	1040	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Danpemej.exeDpapaj32.exeea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danpemej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe

Modifies registry class 9 IoCs

Processes:

ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exeDanpemej.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbehjc32.dll"	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danpemej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Danpemej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danpemej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exeDanpemej.exeDpapaj32.exe

description	pid	process	target process
PID 2148 wrote to memory of 2844	2148	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe	Danpemej.exe
PID 2148 wrote to memory of 2844	2148	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe	Danpemej.exe
PID 2148 wrote to memory of 2844	2148	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe	Danpemej.exe
PID 2148 wrote to memory of 2844	2148	ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe	Danpemej.exe
PID 2844 wrote to memory of 1040	2844	Danpemej.exe	Dpapaj32.exe
PID 2844 wrote to memory of 1040	2844	Danpemej.exe	Dpapaj32.exe
PID 2844 wrote to memory of 1040	2844	Danpemej.exe	Dpapaj32.exe
PID 2844 wrote to memory of 1040	2844	Danpemej.exe	Dpapaj32.exe
PID 1040 wrote to memory of 2920	1040	Dpapaj32.exe	WerFault.exe
PID 1040 wrote to memory of 2920	1040	Dpapaj32.exe	WerFault.exe
PID 1040 wrote to memory of 2920	1040	Dpapaj32.exe	WerFault.exe
PID 1040 wrote to memory of 2920	1040	Dpapaj32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe
"C:\Users\Admin\AppData\Local\Temp\ea57980c4f83c86e67990216ec214a28ed92496526197f77188901fb0e593d9f.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\Danpemej.exe
  C:\Windows\system32\Danpemej.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\Dpapaj32.exe
    C:\Windows\system32\Dpapaj32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 144
      4⤵
      Loads dropped DLL
      Program crash
      PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Danpemej.exe

Filesize
69KB

MD5
d2f98d8a2d15a583d53a60f3ae11d456

SHA1
6b03bd708fe542391085362f2f95a457ceab33ff

SHA256
72a1edc99a75fb46ae5c2ef632a34413a2b4b30624b109237b8dcbda3a7df3af

SHA512
b5dd1b00857e7b987a9c3665d1cce013a2f466da31b48a672f638731ad7602e088831b23a7b8baa39f40537f831985f7da78fd70b1752c07d6deb4ad7b5e266a

Download Submit
\Windows\SysWOW64\Dpapaj32.exe

Filesize
69KB

MD5
00ebc75126c5aed09229aacdc49845c2

SHA1
90f8c35f7f412e376aa372ded648cb14c5592c7d

SHA256
dc03dd323a3f50bfc685f6d138434501c5b2c4d1a929dd8726bc5ae5fa65bd9a

SHA512
e20db89f89667cf8f986ea61e91557b5228e6f8d21381e58d7e7597ba1044d7c067d60b44de51f6b841351aaa78e42974e49210a7fdb218db4dc144edb436fd2

Download Submit
memory/1040-35-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2148-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2148-12-0x0000000000260000-0x000000000029C000-memory.dmp

Filesize
240KB

Download
memory/2148-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2844-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2844-20-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/2844-34-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads