berbew | 729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/12/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Size 90KB
Sample241209-2f3bssynep
SHA256 729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32
MD5 64f8a157dfd1f38a298c94a427d351a3
SHA1 85df6f4d4caf78f21c62ef12b8d2f5d64fdf1e12
SHA512 b54e1b6df53b22b273d1f4ad57b82df9a1d7b81261c513a7212b2fddcc7930903907e6e845a413c3a8c69b96ebd5dddc15a539e97fc7004208032edcf66573aa
SSDEEP 1536:PtL9XhVtkDmI+D3pinl3MXxqEZ4yFOuPktaBUfC1tBF0/DR9ifhGGKu/Ub0VkVNK:NlSa4nmX4iJFOkktaBUfClil9ifEGKuj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgechbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmgechbh.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 2 IoCs

pid	Process
2704	Cmgechbh.exe
2948	Cacacg32.exe

Loads dropped DLL 8 IoCs

pid	Process
2792	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
2792	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
2704	Cmgechbh.exe
2704	Cmgechbh.exe
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe
2752	WerFault.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fdlpjk32.dll	Cmgechbh.exe
File created	C:\Windows\SysWOW64\Cmgechbh.exe	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgechbh.exe	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
File created	C:\Windows\SysWOW64\Gnnffg32.dll	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
File created	C:\Windows\SysWOW64\Cacacg32.exe	Cmgechbh.exe
File opened for modification	C:\Windows\SysWOW64\Cacacg32.exe	Cmgechbh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2948	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgechbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacacg32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnnffg32.dll"	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgechbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdlpjk32.dll"	Cmgechbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmgechbh.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2704	2792	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe	30
PID 2792 wrote to memory of 2704	2792	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe	30
PID 2792 wrote to memory of 2704	2792	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe	30
PID 2792 wrote to memory of 2704	2792	729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe	30
PID 2704 wrote to memory of 2948	2704	Cmgechbh.exe	31
PID 2704 wrote to memory of 2948	2704	Cmgechbh.exe	31
PID 2704 wrote to memory of 2948	2704	Cmgechbh.exe	31
PID 2704 wrote to memory of 2948	2704	Cmgechbh.exe	31
PID 2948 wrote to memory of 2752	2948	Cacacg32.exe	32
PID 2948 wrote to memory of 2752	2948	Cacacg32.exe	32
PID 2948 wrote to memory of 2752	2948	Cacacg32.exe	32
PID 2948 wrote to memory of 2752	2948	Cacacg32.exe	32

C:\Users\Admin\AppData\Local\Temp\729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe
"C:\Users\Admin\AppData\Local\Temp\729766aa190d11658b1a57cbeddf967b7c71953e03645a6e2b0d4b52ff2e7d32.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\Cmgechbh.exe
  C:\Windows\system32\Cmgechbh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\Cacacg32.exe
    C:\Windows\system32\Cacacg32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 140
      4⤵
      Loads dropped DLL
      Program crash
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cacacg32.exe

Path C:\Windows\SysWOW64\Cacacg32.exe
Size 90KB
SHA256 faab58eaba1632f62ce82e8e323f3da89ce99f46ae7ef7f3343625f485d8bd8f
MD5 c5886dd3c40f175b13f9647f7da49930
SHA1 6ff418bb4d12890a36589a21b1a48d827ff08952
SHA512 85b9b589798d66f810e83baa9d87ab0e414e2a5f2d38a8a1f9ce13e45f240852c49a10d70ec2fb27e4beb21617f50dd09f15932021af8a46f0816cc0e32305ea
SSDEEP 1536:7m2N2n85hlcSBosni0zf3GbtD94hGOu/Ub0VkVNK:hN2n85hlsUvGbshGOu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmgechbh.exe

Path \Windows\SysWOW64\Cmgechbh.exe
Size 90KB
SHA256 08b002b8e8549333af58e6ee0f594d57d3940f86c429ebf11805489eb36d477b
MD5 8b86f9584524791e1a9c188abe7ee6de
SHA1 a588fe2e06677cea278371121a029afe0c9f720c
SHA512 96db939ee2de61c9cc1708f5c9ae247f67e91846c194f31e691489c615c8655fb46f968d52cb8ff295e3905ea2bea5494a0e7d2f073277ecfad1df9d6ea97d0a
SSDEEP 1536:thKTFOjW0gQpDYo8e2QeXVXxpf5hL3iUK/PwlvQGXu/Ub0VkVNK:m5sRDYo8lVXxpfDDiUK/o6GXu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2704-19-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2792-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2792-13-0x00000000003B0000-0x00000000003ED000-memory.dmp

Download

memory/2792-12-0x00000000003B0000-0x00000000003ED000-memory.dmp

Download

memory/2792-32-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2948-27-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2948-33-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads