berbew | f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803

General

Target

f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Size

92KB
MD5

cec9c156df23e3e69fcbda09e5f183cc
SHA1

30d779237064d0e429e2294f72f3d216e915713f
SHA256

f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803
SHA512

a01a91a6e68d8ac22ab25c7f4d88ec0d046927faafb0628970a97d9b650c3a8b3322813f970b7452135af5417fe432dddb0b2a7327bc585add186b401d3e25a2
SSDEEP

1536:RSp7V9Y0lYIW58hX/61nEM9/BZ/v/8UGAqTRZQWY0OBnKQrUoR24HsUs:oh9XlH/61kUDqTtpT6THsR

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Faijggao.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnjnkkbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnjnkkbk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faijggao.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 3 IoCs

pid	Process
2380	Fnjnkkbk.exe
2052	Faijggao.exe
2792	Flnndp32.exe

Loads dropped DLL 10 IoCs

pid	Process
1760	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
1760	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
2380	Fnjnkkbk.exe
2380	Fnjnkkbk.exe
2052	Faijggao.exe
2052	Faijggao.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fnjnkkbk.exe	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
File opened for modification	C:\Windows\SysWOW64\Fnjnkkbk.exe	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
File created	C:\Windows\SysWOW64\Faijggao.exe	Fnjnkkbk.exe
File opened for modification	C:\Windows\SysWOW64\Faijggao.exe	Fnjnkkbk.exe
File created	C:\Windows\SysWOW64\Kfadkk32.dll	Fnjnkkbk.exe
File created	C:\Windows\SysWOW64\Onndkg32.dll	Faijggao.exe
File created	C:\Windows\SysWOW64\Odlkfk32.dll	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
File created	C:\Windows\SysWOW64\Flnndp32.exe	Faijggao.exe
File opened for modification	C:\Windows\SysWOW64\Flnndp32.exe	Faijggao.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	2792	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnjnkkbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Faijggao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flnndp32.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfadkk32.dll"	Fnjnkkbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fnjnkkbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Faijggao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onndkg32.dll"	Faijggao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fnjnkkbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Faijggao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odlkfk32.dll"	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2380	1760	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe	30
PID 1760 wrote to memory of 2380	1760	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe	30
PID 1760 wrote to memory of 2380	1760	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe	30
PID 1760 wrote to memory of 2380	1760	f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe	30
PID 2380 wrote to memory of 2052	2380	Fnjnkkbk.exe	31
PID 2380 wrote to memory of 2052	2380	Fnjnkkbk.exe	31
PID 2380 wrote to memory of 2052	2380	Fnjnkkbk.exe	31
PID 2380 wrote to memory of 2052	2380	Fnjnkkbk.exe	31
PID 2052 wrote to memory of 2792	2052	Faijggao.exe	32
PID 2052 wrote to memory of 2792	2052	Faijggao.exe	32
PID 2052 wrote to memory of 2792	2052	Faijggao.exe	32
PID 2052 wrote to memory of 2792	2052	Faijggao.exe	32
PID 2792 wrote to memory of 3016	2792	Flnndp32.exe	33
PID 2792 wrote to memory of 3016	2792	Flnndp32.exe	33
PID 2792 wrote to memory of 3016	2792	Flnndp32.exe	33
PID 2792 wrote to memory of 3016	2792	Flnndp32.exe	33

C:\Users\Admin\AppData\Local\Temp\f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe
"C:\Users\Admin\AppData\Local\Temp\f03200fe95059ee541c22a5ae223bb7f1a64e055ca711d22a12f2b05f84dc803.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\Fnjnkkbk.exe
  C:\Windows\system32\Fnjnkkbk.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\Faijggao.exe
    C:\Windows\system32\Faijggao.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\Flnndp32.exe
      C:\Windows\system32\Flnndp32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 140
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Faijggao.exe

Filesize
92KB

MD5
bb43c775319309e69a4dbf3901fbcc23

SHA1
8446a6a99893b8694247d0bbbf788995586f75d9

SHA256
291b629da7d7b2c3d0c765a02cc33719a2871f17772124fe0f00339e1cb9ff8d

SHA512
4c1446cc05a8a1f631ba221f91c36a4b4971577e0af2a792f8a107bda40106b32c2312f5c43ced090a0de69401dd8934a0529644cdea8705d565cc87e6795bb2

Download Submit
\Windows\SysWOW64\Flnndp32.exe

Filesize
92KB

MD5
53dffa53eef3372c2f5468e4ef0113e5

SHA1
c69b83d3d79f8a4d0ab6106584b0bfad20cfa5c9

SHA256
2996d43d81114fec5dd7e884d87acfa58dd6f45dd563fe9f53de5c072ffe3d5b

SHA512
a7790eed4dc73af7675cd612e3edfeec23902dcf9e1cf6829b809ca2e770df4f43f0821bddbdc3292828d3d517f4f4ffdd6f1f317b929955240bf11fd9602768

Download Submit
\Windows\SysWOW64\Fnjnkkbk.exe

Filesize
92KB

MD5
7a43e3667b0cbe91026afa56266755f0

SHA1
aff58299945c279a207a39348d068de21d018474

SHA256
6a911a559ce916e39ec3952dd71cc0ad073f70c7da7ff977fa3f7e38055b42b0

SHA512
4f03235894794f7d0b915178a44eb54b8c6b8452038c1b7ae7a2c606e2896175c17077215a86fb5a821076458c04bf15af9d3c028c9dee12c76527f88199b2db

Download Submit
memory/1760-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1760-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1760-11-0x0000000000250000-0x000000000028F000-memory.dmp

Filesize
252KB

Download
memory/2052-26-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2052-40-0x0000000000280000-0x00000000002BF000-memory.dmp

Filesize
252KB

Download
memory/2052-39-0x0000000000280000-0x00000000002BF000-memory.dmp

Filesize
252KB

Download
memory/2052-46-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2380-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2792-41-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2792-47-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads