berbew | e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3

General

Target

e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Size

860KB
MD5

dd951023c6f0631cf1c5513483cab630
SHA1

25c0a00409c01360e361c0657d4d4a1984fcb163
SHA256

e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3
SHA512

407dd8969d2e8fe706b1964dfca57675f86ec4e61722706c9582859a3900b5f1a1481d1c582eeb3bde388a5195f27082dd01392b54b13390eed382b17d6aa6f8
SSDEEP

24576:gny5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:gnRbazR0vD

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khldkllj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmimcbja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmimcbja.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khldkllj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 3 IoCs

pid	Process
2792	Khldkllj.exe
2780	Kmimcbja.exe
2916	Lbjofi32.exe

Loads dropped DLL 10 IoCs

pid	Process
2124	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
2124	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
2792	Khldkllj.exe
2792	Khldkllj.exe
2780	Kmimcbja.exe
2780	Kmimcbja.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe
2820	WerFault.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Khldkllj.exe	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
File created	C:\Windows\SysWOW64\Eghoka32.dll	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
File opened for modification	C:\Windows\SysWOW64\Lbjofi32.exe	Kmimcbja.exe
File created	C:\Windows\SysWOW64\Khldkllj.exe	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
File created	C:\Windows\SysWOW64\Kmimcbja.exe	Khldkllj.exe
File opened for modification	C:\Windows\SysWOW64\Kmimcbja.exe	Khldkllj.exe
File created	C:\Windows\SysWOW64\Bodilc32.dll	Khldkllj.exe
File created	C:\Windows\SysWOW64\Lbjofi32.exe	Kmimcbja.exe
File created	C:\Windows\SysWOW64\Ipafocdg.dll	Kmimcbja.exe

Program crash 1 IoCs

pid	pid_target	Process
2820	2916	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khldkllj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmimcbja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbjofi32.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghoka32.dll"	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bodilc32.dll"	Khldkllj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khldkllj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipafocdg.dll"	Kmimcbja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khldkllj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmimcbja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmimcbja.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2792	2124	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe	30
PID 2124 wrote to memory of 2792	2124	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe	30
PID 2124 wrote to memory of 2792	2124	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe	30
PID 2124 wrote to memory of 2792	2124	e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe	30
PID 2792 wrote to memory of 2780	2792	Khldkllj.exe	31
PID 2792 wrote to memory of 2780	2792	Khldkllj.exe	31
PID 2792 wrote to memory of 2780	2792	Khldkllj.exe	31
PID 2792 wrote to memory of 2780	2792	Khldkllj.exe	31
PID 2780 wrote to memory of 2916	2780	Kmimcbja.exe	32
PID 2780 wrote to memory of 2916	2780	Kmimcbja.exe	32
PID 2780 wrote to memory of 2916	2780	Kmimcbja.exe	32
PID 2780 wrote to memory of 2916	2780	Kmimcbja.exe	32
PID 2916 wrote to memory of 2820	2916	Lbjofi32.exe	33
PID 2916 wrote to memory of 2820	2916	Lbjofi32.exe	33
PID 2916 wrote to memory of 2820	2916	Lbjofi32.exe	33
PID 2916 wrote to memory of 2820	2916	Lbjofi32.exe	33

C:\Users\Admin\AppData\Local\Temp\e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe
"C:\Users\Admin\AppData\Local\Temp\e93ea4a40607547ea4f40038e2681b16a45623760480ac2fc95c2f53b2a310e3N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\Khldkllj.exe
  C:\Windows\system32\Khldkllj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\Kmimcbja.exe
    C:\Windows\system32\Kmimcbja.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\SysWOW64\Lbjofi32.exe
      C:\Windows\system32\Lbjofi32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 140
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Khldkllj.exe

Filesize
860KB

MD5
3eb7c94cfa8517a21d3d2b3d16a95bea

SHA1
19327f3fcf54b856619fe166a9ba02b5d8442df5

SHA256
b5dffecc4e0e194b73378c4b9a1cc872e0a3243e6e54e7e236cd40816254411f

SHA512
1c7cceb6c56092c15965be5a3cada96efc3c1a97b40f66eb882390f840be6daa7e3f03718cac050726aff103e7f6d494e2370316cd2ab85a6ea0309446118a7b

Download Submit
C:\Windows\SysWOW64\Kmimcbja.exe

Filesize
860KB

MD5
06ca23a627ca51082b330a8a854f2707

SHA1
2ab8518e7f20b855fcba68f515be59c0ff1194ac

SHA256
6fdd9198e9cda20ffeeadfb6fe488d0ffc65d02b777b76edb2afb4d59b0a5641

SHA512
270d5146ac6c132c5cec5f2f12cae245633e9aa836b7ed0bec52b48462dea55f5381caeeef15e6123beb7aff34a55315876f8373a656b6afaa6197bf9ca4aab6

Download Submit
\Windows\SysWOW64\Lbjofi32.exe

Filesize
860KB

MD5
3482bcc7587f0220f3ba75eeb1eb28e4

SHA1
36b926f06d0379019d7728d110013f807e3e03bf

SHA256
f5db4806ea0f4934434334da7dfa6a383fa564170f8bc53ee5340552131be3ab

SHA512
9622ba6d7544d3f9f84b9358e2a1a02d7eb44f5b5b6a541fb3265b250ae1dd3fe6c01edf4453efc2011b23ea8ca51c1102ae36c5e79c0d740c5ea754b9599a7b

Download Submit
memory/2124-18-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2124-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-17-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2780-41-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2780-42-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2780-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-27-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2792-28-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2916-43-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads