berbew | 4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Size 92KB
Sample260903-j6f75sysb1
SHA256 4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c
MD5 30e885e51e870c0c63826c20ca4bfadc
SHA1 46028262e40ea2ca8ec7f8fdf8297260ef957afc
SHA512 ddd76c27754c7e1dab23c4f20ffb7de57cdfcde0f6c97853b8c610288dd4bb809d4da390483308d4b0500cd0e14f8e512f83eb1da3e7f4a69cc69e212f040628
SSDEEP 1536:+preDn2xhYNqlZ6YOBc0qOqxYlpdD3V0NSAYRQ7n2RzBvrk3HR96TC+qRbDb1Si/:iAqlZ61BcbqdD3V00peL203H/6TC+qFn
TLSH
T1C8936B5F774B8F66C68115B20119197FA77BD0FB4B3D48C855A983CF22BBE0602B9E09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe

Executes dropped EXE 3 IoCs

pid	Process
3512	Dpkmal32.exe
4248	Dhbebj32.exe
2540	Dkqaoe32.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Glfdiedd.dll	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Dhbebj32.exe	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Dgihjf32.dll	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
File opened for modification	C:\Windows\SysWOW64\Dpkmal32.exe	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
File created	C:\Windows\SysWOW64\Omjbpn32.dll	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
File opened for modification	C:\Windows\SysWOW64\Dhbebj32.exe	Dpkmal32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2540	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omjbpn32.dll"	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgihjf32.dll"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3512	4912	4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe	85
PID 3512 wrote to memory of 4248	3512	Dpkmal32.exe	86
PID 4248 wrote to memory of 2540	4248	Dhbebj32.exe	87

C:\Users\Admin\AppData\Local\Temp\4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe
"C:\Users\Admin\AppData\Local\Temp\4c2a50256e28289c9434e1724f0ca09ac096b765f5096e95552a03a5d7da2b8c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\Dpkmal32.exe
  C:\Windows\system32\Dpkmal32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\Dhbebj32.exe
    C:\Windows\system32\Dhbebj32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\Dkqaoe32.exe
      C:\Windows\system32\Dkqaoe32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 412
        5⤵
        Program crash
        
        PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2540 -ip 2540
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dhbebj32.exe

Path C:\Windows\SysWOW64\Dhbebj32.exe
Size 92KB
SHA256 565530d5824d83cc4153ea09e914f4b508e605cf510056c0498cc0fe6b1aa2ed
MD5 2912b4c9b8f9aeae70c66e70eb8f2361
SHA1 35e15a9a8b9af34a1448dace6a2d602a2bfaf48c
SHA512 3f630e0f8792dd53dc8dd389782722f6cd5fbdaa7742f2f750d74aea13e90f8e96dafefbff567ca90c3f69489b8230b4bec2e643225c9d4fe0e0c86d45560ba4
SSDEEP 1536:wYR7MawPcDdpCNu+cHp0QzXIegUhRQJn2RzBvrk3HR96TC+qRbDb1Si/:r00PCg+cHp0+Hrhed203H/6TC+qF1SY
TLSH
T1A4939CDF62801E63D75116F7317BBE957614F479322BC27E0E2BC02C665AC290BF98A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dkqaoe32.exe

Path C:\Windows\SysWOW64\Dkqaoe32.exe
Size 92KB
SHA256 f45102ed2b6afac21c581a626b366067f05f7fbd3b5d2e990c87366a52e18a57
MD5 944791a7119b42f0796b53c1ddbd1dec
SHA1 49d16ab52c132b5d7f4d1522c9144de3d77ecbb7
SHA512 ccb1c7d2b5b5e594542457840796473ffa43fccd1168b69f1c4550aa7402178c6f8053994ea5086f0405e130127936227b88e060ecb3b53ee53c6c2364bc8150
SSDEEP 1536:P2a/AnvTngkztI41JpOX7RQ9n2RzBvrk3HR96TC+qRbDb1Si/:PtInvTgkKsJCeB203H/6TC+qF1SY
TLSH
T1A7936B2ED357CFB2D46016BB680F949A7634D47AFEEFC864E09C890DE0439351279AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpkmal32.exe

Path C:\Windows\SysWOW64\Dpkmal32.exe
Size 92KB
SHA256 c3bf6639bf7cda0a8e455080d38620ade1faea59a17625cb6299815dddda9de6
MD5 276f8247fc3c7cb15275e1af43f32fdc
SHA1 32d94afb2e798bde99f9c82309c8b2e3372c29ef
SHA512 b64acd90911550e13974da7c9e4f301c0a2003ae3fc98645405f467f96c355817e9b6fa22f0279a84a9cf02de9f13dd337c025300c7eac7a45414adcbc129374
SSDEEP 1536:t5NHJYRTcIopn3vfKrTQYCDh3AQ7jytRQSn2RzBvrk3HR96TC+qRbDb1Si/:T0RTcICKrFQSteA203H/6TC+qF1SY
TLSH
T105937C9F699D0E1DF28B0DF1136649BF6705903C023F59A3C1EC623C2616B1AE77A2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2540-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3512-7-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3512-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4248-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4912-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads