bergi[.]cc[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
bergi.cc.dll
Size 8.2MB
Sample261024-2txngasw4p
SHA256 cb783627ad978473d5b996569e16b4d533ea4ee8a5579d27a3ef11e89e1422d8
MD5 5ab522fed18a525c28885060d1152af0
SHA1 ea4687c224cf7eabf5ea029dc59702d757a87f52
SHA512 1fcd2cebc382eaf9f850170c5d9bfe95f913c9767de97d0e91b91c59694a80e42ede800b6a7101c72c09ddfbc6f2279d3d0ee2cc90924fe0e9ca0a23d24adadd
SSDEEP 98304:EVGZGid3iXknYtaNGIbcFHRlnzdNJ77ti8qZNkSyoeNtGq:OGZG1aEg6dNxKZNkjjb
TLSH
T1F9863A11BE4B5968D09ACC70C34786A78A2134DB0A36B4FF25DA562D2F7E7F05F29309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bergi.cc.dll

File Explorer

bergi.cc.dll

.dll 8.2MB

bergi.cc.dll

IMPHASH e3303051357d018777be71e50e3ae621
SHA256 cb783627ad978473d5b996569e16b4d533ea4ee8a5579d27a3ef11e89e1422d8
MD5 5ab522fed18a525c28885060d1152af0
SHA1 ea4687c224cf7eabf5ea029dc59702d757a87f52
SHA512 1fcd2cebc382eaf9f850170c5d9bfe95f913c9767de97d0e91b91c59694a80e42ede800b6a7101c72c09ddfbc6f2279d3d0ee2cc90924fe0e9ca0a23d24adadd
SSDEEP 98304:EVGZGid3iXknYtaNGIbcFHRlnzdNJ77ti8qZNkSyoeNtGq:OGZG1aEg6dNxKZNkjjb
TLSH
T1F9863A11BE4B5968D09ACC70C34786A78A2134DB0A36B4FF25DA562D2F7E7F05F29309
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5576976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\piotr\Desktop\Cs2-HVH-main\Cs2 Internal\obj\command-line\x64\Release\bergi.cc\bergi.cc.pdb

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException SwitchToThread GetProcessHeap RtlPcToFileHeader GetCPInfo GetUserDefaultUILanguage LCIDToLocaleName GetStringTypeW GetFileSizeEx FindClose LCMapStringEx DecodePointer VirtualProtect MultiByteToWideChar AcquireSRWLockShared ReleaseSRWLockShared WakeConditionVariable GetExitCodeThread FlushInstructionCache AreFileApisANSI GetFileAttributesExW FindFirstFileW ResumeThread FormatMessageA LocalFree GetSystemTimeAsFileTime TerminateProcess MoveFileExW IsProcessorFeaturePresent ExitThread GetStartupInfoW IsDebuggerPresent OpenThread GetCurrentProcess SleepConditionVariableSRW WakeAllConditionVariable HeapFree HeapReAlloc HeapAlloc HeapCreate VirtualQuery VirtualFree lstrlenW VirtualAlloc GetSystemInfo FreeLibraryAndExitThread SetStdHandle HeapSize SetEndOfFile GetWindowsDirectoryA GetCurrentThreadId CreateThread GetCurrentProcessId WaitForSingleObject TryAcquireSRWLockExclusive SetLastError GetLastError OutputDebugStringA GetFileAttributesA GetFileInformationByHandleEx GetModuleHandleExW LCMapStringW GetModuleHandleW GetModuleFileNameW LoadLibraryW FreeLibrary Sleep InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive CloseHandle ReadFile GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetFileInformationByHandle EnumSystemLocalesW LoadLibraryA GetFileType FlushFileBuffers WriteFile SetFilePointerEx FlsGetValue Thread32Next Thread32First GetQueuedCompletionStatusEx SuspendThread PostQueuedCompletionStatus CreateIoCompletionPort ReadConsoleW IsValidCodePage CreateToolhelp32Snapshot GetACP GetOEMCP RtlUnwind LoadLibraryExA GlobalFree CreateFileW GetProcAddress GetModuleHandleA LoadLibraryExW OutputDebugStringW GlobalLock GlobalUnlock FindNextFileW SetThreadStackGuarantee GetCurrentThread GetTempPathW FormatMessageW GlobalAlloc GetLocaleInfoEx FlsSetValue IsThreadAFiber CompareStringOrdinal SleepEx ReadFileEx WriteFileEx GetFullPathNameW GetStdHandle DuplicateHandle EncodePointer GetTickCount64 RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime SetFileTime SetFileInformationByHandle GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW CreateDirectoryW FindFirstFileExW ExitProcess WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW WriteConsoleW GetConsoleMode GetConsoleOutputCP FlsAlloc FlsFree CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount InitializeSListHead GetCommandLineA LeaveCriticalSection EnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency GetThreadContext SetThreadContext RtlCaptureContext RtlVirtualUnwind InitializeCriticalSectionEx FreeEnvironmentStringsW GetCurrentDirectoryW GetCommandLineW SetEnvironmentVariableW DeleteCriticalSection GetEnvironmentVariableW GetEnvironmentStringsW InterlockedFlushSList RtlUnwindEx

ole32

CoInitializeEx OleInitialize CreateStreamOnHGlobal CoUninitialize RevokeDragDrop CoCreateInstance RegisterDragDrop

user32

CreateAcceleratorTableW DestroyAcceleratorTable AppendMenuW CreatePopupMenu VkKeyScanW CreateMenu TrackPopupMenu GetParent FindWindowExW SetWindowRgn RegisterWindowMessageA RemoveMenu DrawMenuBar SetMenu GetRawInputData SetPropW SystemParametersInfoA GetKeyboardState SendInput SetForegroundWindow GetMenu GetWindowRect ReleaseDC GetDC IsProcessDPIAware MsgWaitForMultipleObjectsEx CheckMenuItem ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu GetMenuItemInfoW ShowWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateIcon MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW TrackMouseEvent GetActiveWindow UpdateWindow InvalidateRect SetWindowDisplayAffinity SetFocus RegisterTouchWindow GetWindow GetMonitorInfoW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo SystemParametersInfoW GetSystemMetrics GetWindowLongW AdjustWindowRectEx FlashWindowEx InvalidateRgn DestroyIcon GetIconInfo LoadImageW SendMessageW IsWindowEnabled EnableWindow MonitorFromWindow PostQuitMessage SetMenuItemInfoW GetMenuBarInfo GetRegisteredRawInputDevices RegisterRawInputDevices MapWindowPoints TranslateAcceleratorW OffsetRect GetWindowDC SetParent MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect IsIconic PostMessageW DispatchMessageW GetMessageW EnumChildWindows DispatchMessageA TranslateMessage GetMessageA InsertMenuW SetWindowPos RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint MapVirtualKeyA GetKeyNameTextA LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseCapture SetCapture GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard DrawTextW GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW GetForegroundWindow GetAsyncKeyState IsWindowVisible DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW DestroyMenu FillRect DrawIconEx

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetCompositionStringW ImmGetContext

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shlwapi

SHCreateMemStream

ntdll

NtWriteFile NtCancelIoFileEx NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile RtlGetVersion NtDeviceIoControlFile

comctl32

DefSubclassProc TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass

gdi32

GetDeviceCaps BitBlt DeleteDC GetDIBits CreateCompatibleDC CombineRgn CreateDIBSection SelectObject CreateRectRgn SetBkMode SetTextColor DeleteObject CreateSolidBrush

bcryptprimitives

ProcessPrng

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

shell32

DragQueryFileW DragFinish SHGetKnownFolderPath SHGetStockIconInfo SHAppBarMessage

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW RegGetValueW EventRegister EventWriteTransfer EventUnregister EventSetInformation

combase

CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

xinput1_4

ord4 ord2

bcrypt

BCryptCreateHash BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

248KB

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bergi.cc.dll

kernel32

ole32

user32

imm32

oleaut32

api-ms-win-core-synch-l1-2-0

shlwapi

ntdll

comctl32

gdi32

bcryptprimitives

dwmapi

shell32

advapi32

combase

api-ms-win-core-winrt-error-l1-1-0

d3d11

d3dcompiler_47

xinput1_4

bcrypt

generic