berbew | a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198

General

Target

a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Size

92KB
MD5

552d8bb79b792c78e821c1ac2cfc1f80
SHA1

2882b0b1958e1c531e92df54c73f929b21becbac
SHA256

a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198
SHA512

1c43861a7c2653f4da1d0ef75ece3bd6f5e2a4f85485c1433c1038c2cdd19f26e00c0e6bb17a22cf1154a46a2f396f6ce85be0404b6f851c94a1b65a7315051b
SSDEEP

1536:OXEq82JQ8zdLj6APuHX9HzT7Qd9OyPFC/DQ6d+LdN3imnunGP+W:Wt8EV6AP+XBTQtPF8ydVbe4+W

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 2 IoCs

pid	Process
4136	Dddhpjof.exe
3112	Dmllipeg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	3112	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4136	2260	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe	85
PID 2260 wrote to memory of 4136	2260	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe	85
PID 2260 wrote to memory of 4136	2260	a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe	85
PID 4136 wrote to memory of 3112	4136	Dddhpjof.exe	86
PID 4136 wrote to memory of 3112	4136	Dddhpjof.exe	86
PID 4136 wrote to memory of 3112	4136	Dddhpjof.exe	86

C:\Users\Admin\AppData\Local\Temp\a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe
"C:\Users\Admin\AppData\Local\Temp\a804cb1666db7e6a2c840eaf738cd71f6ecf8f2b950ec47b491146f8b90fb198N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\Dddhpjof.exe
  C:\Windows\system32\Dddhpjof.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\Dmllipeg.exe
    C:\Windows\system32\Dmllipeg.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 408
      4⤵
      Program crash
      PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3112 -ip 3112
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
92KB

MD5
2c98ef441adc6983c418907e7c9a7b44

SHA1
1e65c9aecd094ca44a1c9e3660ec6c2ac4077e09

SHA256
b0a86641292194fa73322c5a786a8a0637f9d172c40f9140acfb2140d2afeb87

SHA512
a4033255d0428ce84f9a9be585017b3c79d6d67c5ea9aa5ebef4b59edfb52af60532b1341903b1e04415c9941a45b7498d62eeaf761d38d518d66f2c8ee95c17

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
92KB

MD5
c77b1426de1d17e586ab7c7dc7e0341b

SHA1
3fdb577bd3f8eb5d08f39e935fc1e18bdc1ee73c

SHA256
2259551fcf9a2e15a94da4727d1c835c392f69a161a3fe3782357d1a0e9f7b66

SHA512
746bbf77efea413aa159f26eaada8a4f68007ec1f64e407d048e55c59c10b9f95a07cbb2ff44b600b914f13dd8157fefe4b70e97bf800d7d249d284ce0b13eda

Download Submit
memory/2260-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2260-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3112-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3112-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4136-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4136-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads