berbew | 0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af

General

Target

0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Size

186KB
MD5

ba58a9704bae7f045db4333207e5efb7
SHA1

b1d0c4f383e3c119f04aeb479784430dd21aca45
SHA256

0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af
SHA512

9477fc789eaad9a59fa6ad250ed24d6e02f698d7da44248ed2efbea2805b82a7ee23252859865978e451e35750780f218da1837478a109775665fc6976291606
SSDEEP

3072:OEjCMqlA1JFFv+Y4H1vkF3VOMC4uMhZpMdoVBRDI+Vvlg3vGp:OEN2A1JFF+Jk/4AcgHuvw

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eebibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eebibf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fllaopcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fllaopcg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 3 IoCs

pid	Process
2380	Eebibf32.exe
2700	Fllaopcg.exe
2728	Flnndp32.exe

Loads dropped DLL 10 IoCs

pid	Process
1940	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
1940	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
2380	Eebibf32.exe
2380	Eebibf32.exe
2700	Fllaopcg.exe
2700	Fllaopcg.exe
2756	WerFault.exe
2756	WerFault.exe
2756	WerFault.exe
2756	WerFault.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fllaopcg.exe	Eebibf32.exe
File created	C:\Windows\SysWOW64\Flnndp32.exe	Fllaopcg.exe
File opened for modification	C:\Windows\SysWOW64\Flnndp32.exe	Fllaopcg.exe
File created	C:\Windows\SysWOW64\Onndkg32.dll	Fllaopcg.exe
File created	C:\Windows\SysWOW64\Eebibf32.exe	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
File opened for modification	C:\Windows\SysWOW64\Eebibf32.exe	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
File created	C:\Windows\SysWOW64\Fpkljm32.dll	Eebibf32.exe
File created	C:\Windows\SysWOW64\Mnmcojmg.dll	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
File created	C:\Windows\SysWOW64\Fllaopcg.exe	Eebibf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2728	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eebibf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fllaopcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flnndp32.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eebibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkljm32.dll"	Eebibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eebibf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnmcojmg.dll"	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fllaopcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onndkg32.dll"	Fllaopcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fllaopcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2380	1940	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe	30
PID 1940 wrote to memory of 2380	1940	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe	30
PID 1940 wrote to memory of 2380	1940	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe	30
PID 1940 wrote to memory of 2380	1940	0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe	30
PID 2380 wrote to memory of 2700	2380	Eebibf32.exe	31
PID 2380 wrote to memory of 2700	2380	Eebibf32.exe	31
PID 2380 wrote to memory of 2700	2380	Eebibf32.exe	31
PID 2380 wrote to memory of 2700	2380	Eebibf32.exe	31
PID 2700 wrote to memory of 2728	2700	Fllaopcg.exe	32
PID 2700 wrote to memory of 2728	2700	Fllaopcg.exe	32
PID 2700 wrote to memory of 2728	2700	Fllaopcg.exe	32
PID 2700 wrote to memory of 2728	2700	Fllaopcg.exe	32
PID 2728 wrote to memory of 2756	2728	Flnndp32.exe	33
PID 2728 wrote to memory of 2756	2728	Flnndp32.exe	33
PID 2728 wrote to memory of 2756	2728	Flnndp32.exe	33
PID 2728 wrote to memory of 2756	2728	Flnndp32.exe	33

C:\Users\Admin\AppData\Local\Temp\0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe
"C:\Users\Admin\AppData\Local\Temp\0108f115555bbbe3b157bc8ad2465eb1d3ae0f56fa8583a66d8ba8139d93b7af.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\Eebibf32.exe
  C:\Windows\system32\Eebibf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\Fllaopcg.exe
    C:\Windows\system32\Fllaopcg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SysWOW64\Flnndp32.exe
      C:\Windows\system32\Flnndp32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 140
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Eebibf32.exe

Filesize
186KB

MD5
097b023eee2298839e3fa6eb85afa5b8

SHA1
82fea99c088f3501ff269a014c7de56d1a792933

SHA256
e6c330fa830e8bbecca6ef182b180c5fc2a525716675d9a56526dff6e295b5b0

SHA512
0cb57bda97b0820894278ddf2cfed8d3cd649772d6fe2fe36e088862f3cfd02c0d108bcab79acb8d8e60c5bdde4ddbd756d047de541ef3ef9d272edf4910c3e5

Download Submit
\Windows\SysWOW64\Fllaopcg.exe

Filesize
186KB

MD5
5578e08d3d8bad46a3bb288a0d6e5ee5

SHA1
b0c39ece16ba4e72c698eda3644d01ec6a267012

SHA256
ee8206f027493392e52fe62000c8e036d3c024fe390bca8be93a98eab670b5a7

SHA512
d882fc24be417942e1dff8351009595865a6d21db488ce0ac5a15fec58a66940fa28df94017a637c4aff9d712f9fa203b7d8e1568d41d8d166c3823d025006ab

Download Submit
\Windows\SysWOW64\Flnndp32.exe

Filesize
186KB

MD5
3b20abbe7c9866a542af3414422ba9e0

SHA1
548436d4e133fa3a8d47360de1287b71ed026134

SHA256
0035d375ec718ed062808d62797b170aa5563c2ab6952cef546d554aee1d0fc6

SHA512
76a0370df238bee18ee5ee49f124f2ef3cbd642249acefe8cff07069ac80b1c1663702784896bc45a801d9cb26b72ce2c07a9d2a9f8a1d785c51cdb15d63d861

Download Submit
memory/1940-11-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/1940-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-12-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/2380-21-0x0000000000310000-0x0000000000343000-memory.dmp

Filesize
204KB

Download
memory/2380-28-0x0000000000310000-0x0000000000343000-memory.dmp

Filesize
204KB

Download
memory/2380-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2728-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2728-52-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads