Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 04:10
Static task
static1
Behavioral task
behavioral1
Sample
e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe
Resource
win10v2004-20241007-en
General
-
Target
e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe
-
Size
2.5MB
-
MD5
ae94969b981dec798cfffcdb967bd315
-
SHA1
0673c9c57a908c38e6a65a17d65f058bceaf64df
-
SHA256
e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724
-
SHA512
466d84595eb981d70def7a1c13f128cfe57538e315f89ff275f3b41d73282e763c5046d86a7aa48e8db50fa74fa22af18541f9cb30e3f048e2a8aaea6667dd4a
-
SSDEEP
6144:rrn0MIWZxVe6UK+42GTQMJSZO5JVuvw0HBHOnehl:fn0MHCkY660JVaw0HBHOehl
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe -
Berbew family
-
Executes dropped EXE 1 IoCs
pid Process 3740 Dmllipeg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dmllipeg.exe e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe File created C:\Windows\SysWOW64\Kngpec32.dll e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4772 3740 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmllipeg.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 964 wrote to memory of 3740 964 e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe 83 PID 964 wrote to memory of 3740 964 e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe 83 PID 964 wrote to memory of 3740 964 e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe"C:\Users\Admin\AppData\Local\Temp\e78eaf245f36092827e378f48316059071d034ac19cc382eb264a18c5f36f724.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 4083⤵
- Program crash
PID:4772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3740 -ip 37401⤵PID:1068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD52214027d9a16d005990049b50e5d87a2
SHA1e0e8db0b345a06c7bc59c01e683626137ea5ae66
SHA25629a9ea6622a4c0cd039df532dd2824d5095c846e242e9b16a6a2cf4aabcdc207
SHA5127e5900ea7d93b925712e1a0c6ed525758b3612b3c82498651ef9c8b2229e1cd59fe9177eeaf9ac24d50669d2281eb7b03d8b78486cd65cf49f9f2079f7b8f2ae