berbew | 1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52

General

Target

1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Size

285KB
MD5

3df45f886b04f10259e409556afacf30
SHA1

ad923d128db194dfe2899d8b209a978c078f3296
SHA256

1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52
SHA512

adc81df19362eb1207d290927ccc5dbb3be4b58c2f0d663b972757fafc5e0f26397f09c0ef3cbe411edaa1112803afbcbe39be6718e26f5ae0f4111cdead0778
SSDEEP

3072:o7EAP9WoYZSXwuVw86e+KVcbMloVRr3uMg0kAqSxYiJ2QM4GKch:/uH1XlhR+KQIoi7tWa

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 1 IoCs

pid	Process
2068	Fkckeh32.exe

Loads dropped DLL 6 IoCs

pid	Process
800	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
800	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fkckeh32.exe	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
File opened for modification	C:\Windows\SysWOW64\Fkckeh32.exe	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
File created	C:\Windows\SysWOW64\Clkmne32.dll	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	2068	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkckeh32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll"	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2068	800	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe	28
PID 800 wrote to memory of 2068	800	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe	28
PID 800 wrote to memory of 2068	800	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe	28
PID 800 wrote to memory of 2068	800	1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe	28
PID 2068 wrote to memory of 1732	2068	Fkckeh32.exe	29
PID 2068 wrote to memory of 1732	2068	Fkckeh32.exe	29
PID 2068 wrote to memory of 1732	2068	Fkckeh32.exe	29
PID 2068 wrote to memory of 1732	2068	Fkckeh32.exe	29

C:\Users\Admin\AppData\Local\Temp\1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe
"C:\Users\Admin\AppData\Local\Temp\1d8d229498adc509ebaaf4721e8cd69e53eb5f704ac88ce5685c8401d62e8b52N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\Fkckeh32.exe
  C:\Windows\system32\Fkckeh32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 140
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fkckeh32.exe

Filesize
285KB

MD5
9e39c1246e31380b67b1b08c218a75d6

SHA1
8d48e62b894398b4995a0aabd835b68052f4d08a

SHA256
36b05f205363289012f09e9ba5fdbe2890d4fc8c14e5559dfb7cebe558560e89

SHA512
1eb7da709f333393d7260b66eb44c4308820bd05b05ad6e79af51ff96c8acb574c75312aee657bfb476495fa0d502be0d78bf28bc7e036a3b9ec29762fcc1343

Download Submit
memory/800-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/800-12-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/800-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2068-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads