berbew | 738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6

General

Target

738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Size

77KB
MD5

a0d6dc5f9757fa1d4a619f81ad4f1a56
SHA1

0424abf03395e02664469f3b3105f2c6f55d51e2
SHA256

738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6
SHA512

394b0a336c998b13e0b141d2d3f9fcba1450d29b21dac12219aac27f74675ff7b3e4985ee6bda4f93a960d17040199bc915dddb104383cbd11babb77b6317ae9
SSDEEP

1536:5Naj4rCT5wCbz8pWz8wb9Qh2grV242LtMwfi+TjRC/:5NFCTOuz8pu8wc2UKGwf1TjY

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cepipm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmedlk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckmnbg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cchbgi32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 5 IoCs

pid	Process
2548	Cmedlk32.exe
588	Cepipm32.exe
2852	Ckmnbg32.exe
2872	Cchbgi32.exe
3016	Dpapaj32.exe

Loads dropped DLL 13 IoCs

pid	Process
2052	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
2052	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
2548	Cmedlk32.exe
2548	Cmedlk32.exe
588	Cepipm32.exe
588	Cepipm32.exe
2852	Ckmnbg32.exe
2852	Ckmnbg32.exe
2872	Cchbgi32.exe
2872	Cchbgi32.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cepipm32.exe	Cmedlk32.exe
File opened for modification	C:\Windows\SysWOW64\Ckmnbg32.exe	Cepipm32.exe
File created	C:\Windows\SysWOW64\Jhogdg32.dll	Cepipm32.exe
File created	C:\Windows\SysWOW64\Acnenl32.dll	Ckmnbg32.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Cchbgi32.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Cchbgi32.exe
File created	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File created	C:\Windows\SysWOW64\Cmedlk32.exe	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
File created	C:\Windows\SysWOW64\Gdgqdaoh.dll	Cmedlk32.exe
File created	C:\Windows\SysWOW64\Ckmnbg32.exe	Cepipm32.exe
File created	C:\Windows\SysWOW64\Cchbgi32.exe	Ckmnbg32.exe
File opened for modification	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File opened for modification	C:\Windows\SysWOW64\Cmedlk32.exe	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
File created	C:\Windows\SysWOW64\Lmajfk32.dll	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
File opened for modification	C:\Windows\SysWOW64\Cepipm32.exe	Cmedlk32.exe
File opened for modification	C:\Windows\SysWOW64\Cchbgi32.exe	Ckmnbg32.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Cchbgi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	3016	WerFault.exe	35

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmedlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cepipm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckmnbg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cchbgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmajfk32.dll"	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acnenl32.dll"	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Cchbgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cchbgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmedlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cepipm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cchbgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckmnbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgqdaoh.dll"	Cmedlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhogdg32.dll"	Cepipm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cepipm32.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2548	2052	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe	31
PID 2052 wrote to memory of 2548	2052	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe	31
PID 2052 wrote to memory of 2548	2052	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe	31
PID 2052 wrote to memory of 2548	2052	738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe	31
PID 2548 wrote to memory of 588	2548	Cmedlk32.exe	32
PID 2548 wrote to memory of 588	2548	Cmedlk32.exe	32
PID 2548 wrote to memory of 588	2548	Cmedlk32.exe	32
PID 2548 wrote to memory of 588	2548	Cmedlk32.exe	32
PID 588 wrote to memory of 2852	588	Cepipm32.exe	33
PID 588 wrote to memory of 2852	588	Cepipm32.exe	33
PID 588 wrote to memory of 2852	588	Cepipm32.exe	33
PID 588 wrote to memory of 2852	588	Cepipm32.exe	33
PID 2852 wrote to memory of 2872	2852	Ckmnbg32.exe	34
PID 2852 wrote to memory of 2872	2852	Ckmnbg32.exe	34
PID 2852 wrote to memory of 2872	2852	Ckmnbg32.exe	34
PID 2852 wrote to memory of 2872	2852	Ckmnbg32.exe	34
PID 2872 wrote to memory of 3016	2872	Cchbgi32.exe	35
PID 2872 wrote to memory of 3016	2872	Cchbgi32.exe	35
PID 2872 wrote to memory of 3016	2872	Cchbgi32.exe	35
PID 2872 wrote to memory of 3016	2872	Cchbgi32.exe	35
PID 3016 wrote to memory of 2688	3016	Dpapaj32.exe	36
PID 3016 wrote to memory of 2688	3016	Dpapaj32.exe	36
PID 3016 wrote to memory of 2688	3016	Dpapaj32.exe	36
PID 3016 wrote to memory of 2688	3016	Dpapaj32.exe	36

C:\Users\Admin\AppData\Local\Temp\738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe
"C:\Users\Admin\AppData\Local\Temp\738a1e8d4a058623601bb2ee4dedf31b28bb3361ca709ac1850df8a089fcb2c6.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\Cmedlk32.exe
  C:\Windows\system32\Cmedlk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\Cepipm32.exe
    C:\Windows\system32\Cepipm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\Windows\SysWOW64\Ckmnbg32.exe
      C:\Windows\system32\Ckmnbg32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\Cchbgi32.exe
        
        C:\Windows\system32\Cchbgi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2872
      - C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 144
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cepipm32.exe

Filesize
77KB

MD5
7ed459500c90467baa36acb40b6201d5

SHA1
6a3ab7b4f6bab9d17d96f60ef684950b065de2ef

SHA256
04256be32a76731a4f8ff66f151fc180bc6fa4f48c180f5f07b3667c48f60406

SHA512
97ff96ef9aa77b867c3a0d9e7d90fd2926757370552ff70ea366dd2689fd482a6bdd3aea678ad0715fb09166b18362a7aeb057789992b05acf6f4aaaa4be5ef8

Download Submit
\Windows\SysWOW64\Cchbgi32.exe

Filesize
77KB

MD5
4aa62479bbd9c1c0e3897e7d2b28f27f

SHA1
f663380ba7b63a6f9d2b30f497f1a913ea9f7221

SHA256
46ff28ccd3ac84adc6aeebbddbf155d8fe5766434bc09566c5454d0cabe2ac4f

SHA512
01fd56aacd04dd9c86af9000e1f98989eaf165566b365df54b6b4cd95fcf8c0a0d08bf5cb4dafc0fb655178ae345bf6dbf0f14ddb843e0f2542787e992c03eca

Download Submit
\Windows\SysWOW64\Ckmnbg32.exe

Filesize
77KB

MD5
d9b1dd85ae3d84b380498d3972e3daf1

SHA1
5012be775e4e1957e68f7f84382d19b03f8884fe

SHA256
dd6ae73cc551ec1f806deb227556a838960bc137bc9bdb2eb4fabd8e8ecbb4d3

SHA512
e350c634414e47990462b27ef48d85f4f7ff08a76b6c567f39e3007dc1cd0e0c83a4467ad23c3ad2480b35008927e6109b15f17793c518e64c8c9b932b12b46c

Download Submit
\Windows\SysWOW64\Cmedlk32.exe

Filesize
77KB

MD5
126c812bdacc5bf3774d873ba3351e4f

SHA1
6d694c641ae8a4ff46218fbf804f47f6b27d9b5e

SHA256
e1c0091110a1aa3f82506b4ed543b5ed3ffb8d4676864846fbb34642bb8444db

SHA512
be3d5d00bb66264a44409de9e46bdc99d08b31a4f5fba62573f33459fee34789641038457ccaca97c3e3a0fb17cfd93f6481727ec6015d1b0bde78a35bb64e2b

Download Submit
\Windows\SysWOW64\Dpapaj32.exe

Filesize
77KB

MD5
951adb8860ec06ceec4d6e84753fe756

SHA1
b3f5d1565d8cab8d326dd590ca916bad63c60774

SHA256
bb0c118979fa724282e213684b7a5b51a7e86a37353a13d0d5732ddbc81b42d3

SHA512
4bd4d925c5ae9c32ad95beee0e5f364765440e47f2925e2687e410a4286d37ac9ea75b030215eac919bd4c373cdbba41c9925e0f4cf0b193759162da6451436c

Download Submit
memory/588-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/588-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/588-41-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/588-40-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2052-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2052-11-0x0000000001BA0000-0x0000000001BE0000-memory.dmp

Filesize
256KB

Download
memory/2052-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2052-12-0x0000000001BA0000-0x0000000001BE0000-memory.dmp

Filesize
256KB

Download
memory/2548-23-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2548-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-50-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2852-77-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-43-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2872-76-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3016-69-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3016-78-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads