Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 11:24
Behavioral task
behavioral1
Sample
5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe
Resource
win7-20240708-en
General
-
Target
5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe
-
Size
93KB
-
MD5
cd19904657e06b4f5c59de73f20ee023
-
SHA1
bb309cdd3654697096978aad9a44db7d9dbeb437
-
SHA256
5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae
-
SHA512
ab7d7d8b693d3825bad9b91265bab77d4208a7fdd03d0a61235873b8bae9116ba6608d328fbee781696c31628d3522452be1976f8a21080bb9edee1381da5e62
-
SSDEEP
1536:qoSatjAX+UPNs4vRZHERrG51DaYfMZRWuLsV+1R:qoSgjAXzHERragYfc0DV+1R
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbhbai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbhbai32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkojbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkojbf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe -
Berbew family
-
Njrat family
-
Executes dropped EXE 3 IoCs
pid Process 2132 Kbhbai32.exe 2672 Kkojbf32.exe 2884 Lbjofi32.exe -
Loads dropped DLL 11 IoCs
pid Process 2212 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe 2212 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe 2132 Kbhbai32.exe 2132 Kbhbai32.exe 2672 Kkojbf32.exe 2672 Kkojbf32.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe 2724 WerFault.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gffdobll.dll Kbhbai32.exe File created C:\Windows\SysWOW64\Lbjofi32.exe Kkojbf32.exe File created C:\Windows\SysWOW64\Ipafocdg.dll Kkojbf32.exe File created C:\Windows\SysWOW64\Kbhbai32.exe 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe File created C:\Windows\SysWOW64\Bndneq32.dll 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe File opened for modification C:\Windows\SysWOW64\Kkojbf32.exe Kbhbai32.exe File opened for modification C:\Windows\SysWOW64\Lbjofi32.exe Kkojbf32.exe File opened for modification C:\Windows\SysWOW64\Kbhbai32.exe 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe File created C:\Windows\SysWOW64\Kkojbf32.exe Kbhbai32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2724 2884 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbhbai32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkojbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbjofi32.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bndneq32.dll" 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkojbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbhbai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gffdobll.dll" Kbhbai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbhbai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkojbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipafocdg.dll" Kkojbf32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2132 2212 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe 30 PID 2212 wrote to memory of 2132 2212 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe 30 PID 2212 wrote to memory of 2132 2212 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe 30 PID 2212 wrote to memory of 2132 2212 5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe 30 PID 2132 wrote to memory of 2672 2132 Kbhbai32.exe 31 PID 2132 wrote to memory of 2672 2132 Kbhbai32.exe 31 PID 2132 wrote to memory of 2672 2132 Kbhbai32.exe 31 PID 2132 wrote to memory of 2672 2132 Kbhbai32.exe 31 PID 2672 wrote to memory of 2884 2672 Kkojbf32.exe 32 PID 2672 wrote to memory of 2884 2672 Kkojbf32.exe 32 PID 2672 wrote to memory of 2884 2672 Kkojbf32.exe 32 PID 2672 wrote to memory of 2884 2672 Kkojbf32.exe 32 PID 2884 wrote to memory of 2724 2884 Lbjofi32.exe 33 PID 2884 wrote to memory of 2724 2884 Lbjofi32.exe 33 PID 2884 wrote to memory of 2724 2884 Lbjofi32.exe 33 PID 2884 wrote to memory of 2724 2884 Lbjofi32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe"C:\Users\Admin\AppData\Local\Temp\5406775abbbbe4a4a71bbf75eaa7cae72e5f079d1f122338e197e89437a2e7ae.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Kbhbai32.exeC:\Windows\system32\Kbhbai32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\Kkojbf32.exeC:\Windows\system32\Kkojbf32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Lbjofi32.exeC:\Windows\system32\Lbjofi32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1405⤵
- Loads dropped DLL
- Program crash
PID:2724
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD55437c7f0aa32149020ead067bf56be73
SHA14319c8c3ce8fd431afbafb3bd0ac4c4cb532f784
SHA256c1a736525e9a0ee56b4f343481b1758d8f6c3a5dd349063d945937ce8131d228
SHA512069e83f2d9876ab2b5bd09a611878e7e990d7c365edc65f8a870325984377dbd96d4d4f6780abbf99ea484332f7f83ee86407c507deef4ce84b247704a83d905
-
Filesize
93KB
MD5c0362824056b0d6c35078a28672fbd15
SHA190187a3d3cf6550fc86d2cedda6865a03001dfac
SHA256f484adaf354367eba6d4042adea09e9382532b2771f96b09566d03ca5ebfba00
SHA51266c677c2725447ebdc4fa6c851ffbd771300741632f1242ada4de0d63f1c2051d0135faac70953da918e3f9e55d4b02166c3515167339c6a35794ec43ac84018
-
Filesize
93KB
MD5043b3c25a8a853b19549d4ebc4493bf0
SHA11562d5a9d7bfd6a8b03a8bd4a970a11f9ad6fed1
SHA256519e2d1e4ea7440c820360323df9fa26042a94dc65a05c210e967bda47b88327
SHA51279ceb86720e647facc46c658210fc2f51d7cef8ab8efb19647160268ca79d29c65be53d0ec4dd99707a429f93103a88140f16ba7ed283d250b835b055ba48c88