berbew | b74ce8d58bd3438b84c95741226dbb7f89aa3e2ffe8699f0f5e0eb080406984f

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Size 429KB
Sample261101-ww8kvsxthy
SHA256 b74ce8d58bd3438b84c95741226dbb7f89aa3e2ffe8699f0f5e0eb080406984f
MD5 f61f7e76ee97592cae7c9732ea0a1e9d
SHA1 c27df4ed5e1b7eee1223fbd298b7a368c868346b
SHA512 8e20b556e77fc46e2e0698d7047b7a22ad9e75864979a08d4cfbc0a81ad30202d6997e86666df96d71d27f2484798f76a7e58372441519c7a44dbf91e4561f16
SSDEEP 6144:fn8a6GiAV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:fU/NcZ7/N
TLSH
T1679482656A3069E6DDEE6BB5AC2249D88585E5F104F1F13E6633DFDCC8E4DA2CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enpknplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enpknplq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eblgon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eblgon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eejcki32.exe

Executes dropped EXE 4 IoCs

pid	Process
776	Enpknplq.exe
2688	Eblgon32.exe
4648	Eejcki32.exe
3956	Eldlhckj.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eldlhckj.exe	Eejcki32.exe
File created	C:\Windows\SysWOW64\Apleaenp.dll	Eejcki32.exe
File created	C:\Windows\SysWOW64\Enpknplq.exe	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Mmdcde32.dll	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Eblgon32.exe	Enpknplq.exe
File created	C:\Windows\SysWOW64\Deenhilj.dll	Enpknplq.exe
File opened for modification	C:\Windows\SysWOW64\Eejcki32.exe	Eblgon32.exe
File opened for modification	C:\Windows\SysWOW64\Eldlhckj.exe	Eejcki32.exe
File opened for modification	C:\Windows\SysWOW64\Enpknplq.exe	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Eblgon32.exe	Enpknplq.exe
File created	C:\Windows\SysWOW64\Eejcki32.exe	Eblgon32.exe
File created	C:\Windows\SysWOW64\Lifmdfkg.dll	Eblgon32.exe

Program crash 1 IoCs

pid	pid_target	Process
864	3956	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpknplq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eblgon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eejcki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eldlhckj.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enpknplq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eblgon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eblgon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deenhilj.dll"	Enpknplq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eejcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enpknplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifmdfkg.dll"	Eblgon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eejcki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apleaenp.dll"	Eejcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdcde32.dll"	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 776	1344	2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe	85
PID 776 wrote to memory of 2688	776	Enpknplq.exe	86
PID 2688 wrote to memory of 4648	2688	Eblgon32.exe	87
PID 4648 wrote to memory of 3956	4648	Eejcki32.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_f61f7e76ee97592cae7c9732ea0a1e9d_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\Enpknplq.exe
  C:\Windows\system32\Enpknplq.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\Eblgon32.exe
    C:\Windows\system32\Eblgon32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\Eejcki32.exe
      C:\Windows\system32\Eejcki32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 400
        6⤵
        Program crash
        
        PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3956 -ip 3956
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eblgon32.exe

Path C:\Windows\SysWOW64\Eblgon32.exe
Size 429KB
SHA256 fdfd02751a09143d802a789cbbe7d709c24cb17743552b69a74370f4892467dc
MD5 03f44e2767edb48890da856b9d1073cc
SHA1 d0dc5253e87a55c912cd9f837a1c5be05582fee5
SHA512 9b529e3f9a67c161204631d301aa4fc9638a1748fac046b93f65971259562e66d9c128ff69717648052d1e4541925bbcd97ef02ce9f38eaf037713651bd5de42
SSDEEP 6144:LCq/cFV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:LTv/NcZ7/N
TLSH
T1DB9481652A3419E6DDEE6BB5AC1249D88182E8B104F1F13E6633DFEED8E4D61CD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eejcki32.exe

Path C:\Windows\SysWOW64\Eejcki32.exe
Size 429KB
SHA256 7b30a50b57bb31a6211feb2a9c04f5744e546ad2c0b63ac9c962911d86ca9729
MD5 a1c815420864b8e265f681bbd8249564
SHA1 b7c6110bb305a6210c28d4b1fa9a54bde9de89ed
SHA512 b4a610b2857a1e6b56eb4544814679a5f5fa9ab07f82585abf19ec840aa029e1e04239445f59cf1ba0c7de610341568536949e8aac10776fbb70eb35e36f35f7
SSDEEP 6144:yjp4V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:C/NcZ7/N
TLSH
T17D9471256A7019E5DDEEABB5AC1249E98181E4B114F1F13E6633DFDCC8E5E63EC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eldlhckj.exe

Path C:\Windows\SysWOW64\Eldlhckj.exe
Size 429KB
SHA256 4c9012a1cd4ef664100b8ebbe3db4cc9340a23ed554e1726bd28cb7585847d45
MD5 bc02baddb24199a94e60605166f0e22b
SHA1 70edaf31795a982e2265185bbf690b68493e9d5b
SHA512 74df3fb22d6dc21b3188a290744dac387fa5c3649a64000d5673216ffa1c728837966e065a4f09d1776fc9b194396a70ae91f48d85cce650feb3d069a3c4c2cd
SSDEEP 6144:LFNc79GrkV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:pNb/NcZ7/N
TLSH
T1A09483652A3119E5DDEE6BB5AC1249E88181E9B218F1F13E6633DFDCC8E4D62CC44F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enpknplq.exe

Path C:\Windows\SysWOW64\Enpknplq.exe
Size 429KB
SHA256 90d4a86a5ef126964f8ea452dbbdf7e280ba4a8efb2833757624311b3b06979b
MD5 9e34c68b6c618529d195c4fd6cc17a00
SHA1 d5b73f2a5aa76bce463422114fd7a961ffb9f373
SHA512 a1a37edd8ef1191dc492ca5dbe7411da304f28107d19a88f38b458a51d4be12d502f2e25da132431a44e46df1aab239be367224efc57dcdea8e7850e50b7b17b
SSDEEP 6144:iWhSE1u5nV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:iG/NcZ7/N
TLSH
T196949265263419E6EDEEABB5AC1259E88181F4B104F5F13E6633DFDDC8E4D62CC06B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-41-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/776-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1344-43-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1344-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1344-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/2688-39-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2688-16-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3956-36-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3956-32-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4648-38-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4648-24-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads