berbew | 7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120

General

Target

7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Size

128KB
MD5

abe3ea968141f092d8f504173a0a10f5
SHA1

0cb5aa576cfc2b0c110359170d7d96c9acaf34af
SHA256

7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120
SHA512

3c5e1256f2c40632a83d10ad87ed8ce3313af16c52c84121d8a5babf382d683206ef4844fe2dc073238e01680bec9528351ef85f98800347cb44a5d884fe97ef
SSDEEP

3072:dhJ3U6C28JxqEo7RtxnerUEdmjRrz3TIUV4BKm:rO1ziE2xeYEdGTBI

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opmhqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opmhqc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oomlfpdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oomlfpdi.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 3 IoCs

pid	Process
3036	Oomlfpdi.exe
1908	Opmhqc32.exe
2912	Ockdmn32.exe

Loads dropped DLL 10 IoCs

pid	Process
2308	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
2308	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
3036	Oomlfpdi.exe
3036	Oomlfpdi.exe
1908	Opmhqc32.exe
1908	Opmhqc32.exe
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Oomlfpdi.exe	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
File created	C:\Windows\SysWOW64\Mfdfng32.dll	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
File created	C:\Windows\SysWOW64\Opmhqc32.exe	Oomlfpdi.exe
File created	C:\Windows\SysWOW64\Ockdmn32.exe	Opmhqc32.exe
File opened for modification	C:\Windows\SysWOW64\Ockdmn32.exe	Opmhqc32.exe
File created	C:\Windows\SysWOW64\Oomlfpdi.exe	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
File opened for modification	C:\Windows\SysWOW64\Opmhqc32.exe	Oomlfpdi.exe
File created	C:\Windows\SysWOW64\Cdhbbpkh.dll	Oomlfpdi.exe
File created	C:\Windows\SysWOW64\Khhaomjd.dll	Opmhqc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	2912	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oomlfpdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opmhqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ockdmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oomlfpdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opmhqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Opmhqc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oomlfpdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khhaomjd.dll"	Opmhqc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfdfng32.dll"	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdhbbpkh.dll"	Oomlfpdi.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3036	2308	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe	30
PID 2308 wrote to memory of 3036	2308	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe	30
PID 2308 wrote to memory of 3036	2308	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe	30
PID 2308 wrote to memory of 3036	2308	7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe	30
PID 3036 wrote to memory of 1908	3036	Oomlfpdi.exe	31
PID 3036 wrote to memory of 1908	3036	Oomlfpdi.exe	31
PID 3036 wrote to memory of 1908	3036	Oomlfpdi.exe	31
PID 3036 wrote to memory of 1908	3036	Oomlfpdi.exe	31
PID 1908 wrote to memory of 2912	1908	Opmhqc32.exe	32
PID 1908 wrote to memory of 2912	1908	Opmhqc32.exe	32
PID 1908 wrote to memory of 2912	1908	Opmhqc32.exe	32
PID 1908 wrote to memory of 2912	1908	Opmhqc32.exe	32
PID 2912 wrote to memory of 1836	2912	Ockdmn32.exe	33
PID 2912 wrote to memory of 1836	2912	Ockdmn32.exe	33
PID 2912 wrote to memory of 1836	2912	Ockdmn32.exe	33
PID 2912 wrote to memory of 1836	2912	Ockdmn32.exe	33

C:\Users\Admin\AppData\Local\Temp\7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe
"C:\Users\Admin\AppData\Local\Temp\7d60ca6d1492337ce180008090ad352346f9ae41ff404ad23b9359fc0059f120.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\Oomlfpdi.exe
  C:\Windows\system32\Oomlfpdi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\Opmhqc32.exe
    C:\Windows\system32\Opmhqc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\SysWOW64\Ockdmn32.exe
      C:\Windows\system32\Ockdmn32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 140
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Ockdmn32.exe

Filesize
128KB

MD5
011006ba4a06dacafce42680be5c1272

SHA1
604f508aad2729d83162d540a228ca21ced92fd2

SHA256
27b4a71bddc44168b9602d9ef499dc5f2314523a4d2e58aa64b02b131f712696

SHA512
9a173c22e4659246500f56888662b33e86513602faf9002e83433289511532fe8a03aef17a765fd752a133c23a05ad24deb4de8fd42120955f00a2cd621faf69

Download Submit
\Windows\SysWOW64\Oomlfpdi.exe

Filesize
128KB

MD5
022f4461cacdfe03dd363dfa489cfdd3

SHA1
b4693d46dbe28e61d0880c7b7d36caeb90a9f188

SHA256
2e1dc25f212d8b3f336e31faf26647ce8a07fe2449b8419a9dad9bfc767d543d

SHA512
f06e3eb245957f2170886d6ac2b5004c6aeae7262daf0f95bf5f390d212ec7d8fc2b5ef456b698e4818261ff764d30ac483a9fbfd1429bcd4b7cc3c195643609

Download Submit
\Windows\SysWOW64\Opmhqc32.exe

Filesize
128KB

MD5
b57a63b5a40de23fb06b8837ff2e2055

SHA1
1253eff8b9ee7ef073a73ad8d5a361922bbf0f8f

SHA256
c518e4743e7ccbabb74a2c18a40fb6440f47924b768628cf0346c6bc33c19b75

SHA512
c3abbd7df67426b056be19f1a55281c1bdf368c34db1341bb8f8251ce3a2b501ba5e02403b054a3327ae608aa7ee4e5b3efd23952cb135da50564ca144cac8ca

Download Submit
memory/1908-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-13-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2308-12-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/2308-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2912-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2912-52-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3036-28-0x0000000000250000-0x0000000000283000-memory.dmp

Filesize
204KB

Download
memory/3036-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3036-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads