berbew | 9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844

General

Target

9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Size

181KB
MD5

b5f97f7ff4f3b62e61e92d8fb6754750
SHA1

aa36af8ccfcbbe58645dc046e914700177fe813d
SHA256

9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844
SHA512

aad51a5dfd8d04d96bd63d35fad54191d5341c07251a30410a4f10613f8a582590295dfe853ad317d9553d9bfc188c328db26975326279b8decbb773063141ca
SSDEEP

3072:fR5lKNyPfd6zAky6nGw0RLDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOg:fR5l+sh6nGwoR5tTDUZNSN58VU5tT

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdgic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djdgic32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danpemej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danpemej.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 4 IoCs

pid	Process
2844	Cgfkmgnj.exe
2568	Djdgic32.exe
2928	Danpemej.exe
2812	Dpapaj32.exe

Loads dropped DLL 11 IoCs

pid	Process
2148	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
2148	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
2844	Cgfkmgnj.exe
2844	Cgfkmgnj.exe
2568	Djdgic32.exe
2568	Djdgic32.exe
2928	Danpemej.exe
2928	Danpemej.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ccofjipn.dll	Cgfkmgnj.exe
File created	C:\Windows\SysWOW64\Danpemej.exe	Djdgic32.exe
File created	C:\Windows\SysWOW64\Cbehjc32.dll	Djdgic32.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Danpemej.exe
File created	C:\Windows\SysWOW64\Cgfkmgnj.exe	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
File created	C:\Windows\SysWOW64\Djdgic32.exe	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Djdgic32.exe	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Danpemej.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Danpemej.exe
File opened for modification	C:\Windows\SysWOW64\Cgfkmgnj.exe	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
File created	C:\Windows\SysWOW64\Cpmahlfd.dll	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
File opened for modification	C:\Windows\SysWOW64\Danpemej.exe	Djdgic32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32†Daplkmbg.¿xe	Dpapaj32.exe
File created	C:\Windows\system32†Daplkmbg.¿xe	Dpapaj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2812	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danpemej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgfkmgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdgic32.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdgic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danpemej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpmahlfd.dll"	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbehjc32.dll"	Djdgic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danpemej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djdgic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccofjipn.dll"	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Danpemej.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2844	2148	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe	31
PID 2148 wrote to memory of 2844	2148	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe	31
PID 2148 wrote to memory of 2844	2148	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe	31
PID 2148 wrote to memory of 2844	2148	9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe	31
PID 2844 wrote to memory of 2568	2844	Cgfkmgnj.exe	32
PID 2844 wrote to memory of 2568	2844	Cgfkmgnj.exe	32
PID 2844 wrote to memory of 2568	2844	Cgfkmgnj.exe	32
PID 2844 wrote to memory of 2568	2844	Cgfkmgnj.exe	32
PID 2568 wrote to memory of 2928	2568	Djdgic32.exe	33
PID 2568 wrote to memory of 2928	2568	Djdgic32.exe	33
PID 2568 wrote to memory of 2928	2568	Djdgic32.exe	33
PID 2568 wrote to memory of 2928	2568	Djdgic32.exe	33
PID 2928 wrote to memory of 2812	2928	Danpemej.exe	34
PID 2928 wrote to memory of 2812	2928	Danpemej.exe	34
PID 2928 wrote to memory of 2812	2928	Danpemej.exe	34
PID 2928 wrote to memory of 2812	2928	Danpemej.exe	34
PID 2812 wrote to memory of 2728	2812	Dpapaj32.exe	35
PID 2812 wrote to memory of 2728	2812	Dpapaj32.exe	35
PID 2812 wrote to memory of 2728	2812	Dpapaj32.exe	35
PID 2812 wrote to memory of 2728	2812	Dpapaj32.exe	35

C:\Users\Admin\AppData\Local\Temp\9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe
"C:\Users\Admin\AppData\Local\Temp\9e7a3f8d816cb1087ea9f88f02f099b9a2966ce797aa5c62b5f317bc54f42844N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\Cgfkmgnj.exe
  C:\Windows\system32\Cgfkmgnj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\Djdgic32.exe
    C:\Windows\system32\Djdgic32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\Danpemej.exe
      C:\Windows\system32\Danpemej.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 144
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Danpemej.exe

Filesize
181KB

MD5
ef83aaa9d8e4a042b0d78a143023e14f

SHA1
6aadb64977d4d2c54cbae32c3a42fca0d0131c8c

SHA256
c81b65d1ff718b0d17923e4a90571eb30933196295b4ebca15f6249292638633

SHA512
527edd22c9cac5d76756654ef06a4afae1ffe93e87acabdd96dcb2f27b069697ec267fa8efe39aba685dfd83f816bd2f0aa6865db602a72e3742dc8c9ea1e1cf

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
181KB

MD5
f6596f6678c214549646eb3749bf6faa

SHA1
5e88221e9b53a7e05101e448e72876d170cdd07a

SHA256
d19411a1dcfe1735a35d75138b07c96e938485073a43f03657ce0d4d892d0fb4

SHA512
6b245148a976719e4811f1c798dd1b4faee469589edb5e0a9fa66bdd374687a5215e04ea2849eabe9453760bc90950e60125f4f97ebb7c0eb92f8df43453a3c5

Download Submit
\Windows\SysWOW64\Cgfkmgnj.exe

Filesize
181KB

MD5
8151a38a75b955ecd7eef5ea52ab4285

SHA1
d75958f78568adf798154c41b8e1f73c9f1c06db

SHA256
4ecc76d268c32cb3e4b451e3803bbdbfc43a8665aaabcfc13d2485c41613cdf6

SHA512
930d9d4ac531625b8be708a09cd4db3a7b8e1b7ef79f1fd070af85df3c6541f9f97acc748d2295bf03fc33abfc67dfda9bfcaa92d6bd05348c9e5ecc0338b75d

Download Submit
\Windows\SysWOW64\Djdgic32.exe

Filesize
181KB

MD5
8bca698c5ba68d963c7093ce5bd4645d

SHA1
335829120f72ad05330fcea4834260f257db19cd

SHA256
e9e5afecdf918012eff5d60b060142cf2f8e48089f8ae9a3f7f0597bed170e82

SHA512
01aaf6f6d9e8d14433affc45a17129e9acaa08167f9b73b59c3623863f6176eaf3aac61b591644474bee701237de1eb9b9260c63e1dbcd50bbb14582ec3d640e

Download Submit
memory/2148-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2148-13-0x00000000003D0000-0x00000000003FF000-memory.dmp

Filesize
188KB

Download
memory/2148-12-0x00000000003D0000-0x00000000003FF000-memory.dmp

Filesize
188KB

Download
memory/2148-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2568-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2568-45-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2812-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2812-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2844-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2844-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2928-46-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads