berbew | 8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9

General

Target

8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Size

88KB
MD5

3c6faeb5eff8e0f84ab3cc4560ad6c3d
SHA1

63ade206a14f574b8f3fdddc86480dc676ac0a0d
SHA256

8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9
SHA512

1b6521aec56c995d38983f030e8bc77795c2d6fd115592ed7ecda97fbf966b7086d05f851e2004d337f8663a7dadc84f11d4f7906c9d5d6e93f755446e1c3308
SSDEEP

1536:fAhAxpMpiXXbABLJIB99XSZS6muXZ9DwFL8QOVXtE1ukVd71rFZO7+90vT:YhLpiXXbAB43OZWLi9EIIJ15ZO7Vr

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 2 IoCs

pid	Process
4080	Dknpmdfc.exe
4068	Dmllipeg.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
File opened for modification	C:\Windows\SysWOW64\Dknpmdfc.exe	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	4068	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 4080	856	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe	83
PID 856 wrote to memory of 4080	856	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe	83
PID 856 wrote to memory of 4080	856	8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe	83
PID 4080 wrote to memory of 4068	4080	Dknpmdfc.exe	84
PID 4080 wrote to memory of 4068	4080	Dknpmdfc.exe	84
PID 4080 wrote to memory of 4068	4080	Dknpmdfc.exe	84

C:\Users\Admin\AppData\Local\Temp\8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe
"C:\Users\Admin\AppData\Local\Temp\8ae7fe07285d43c2d4d973f6ad98ac7b4eb49cc708a0618bec3be3d0567621b9.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\Dknpmdfc.exe
  C:\Windows\system32\Dknpmdfc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\Dmllipeg.exe
    C:\Windows\system32\Dmllipeg.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 396
      4⤵
      Program crash
      PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4068 -ip 4068
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
88KB

MD5
2f28fb0d8717f18c565916b1f97c818d

SHA1
b64576228e72d3a6571404ca3c3d422d04638bf4

SHA256
3f22ac66267421f5ca9317f4aa33d219685263db44a4e3fab5467f309d29416c

SHA512
c6a849d2284ddae821d5c2df384b01841c4c4183eb9f757a8214e62945844fe3d836f333298f249553016dda216135e1ecace08ab8eab3aae9671b5e52e4e9de

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
88KB

MD5
18b7cfd6cea4a9a00a574ca668a3b785

SHA1
3caa7d2b5f23062f71f1102f6040ab190a9a1d63

SHA256
508e5af9227f4718d717c21975003f1f1950a82d15fd95fc9239ab7d38b1ad21

SHA512
fac4621e15faf34e994f0b3c94dbff6e25a102bc7aa94a830c5707ee20fca7307e93c9b1bcdb1d73d8ab94b10b29e8ea78b073c325bdc6adfefd615ad3239f2d

Download Submit
memory/856-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/856-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4068-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4068-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4080-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4080-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads