Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
18-05-2020 15:42
Static task
static1
Behavioral task
behavioral1
Sample
newbuer.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
newbuer.exe
Resource
win10v200430
General
-
Target
newbuer.exe
-
Size
111KB
-
MD5
4df84f8de8a5526f119c26518b529757
-
SHA1
42d281abeb10649bff097504f20e8fc2c8e85f5c
-
SHA256
9e746625abad522321067f546c40e8b26176ef5585bf3a45cb58ff758738f68c
-
SHA512
68cd6ce9eb7f01d7e6b2b2fff6dfdf981834168cb406a7d67df1f4c9d78b36b22689b03e408e3e68faf76d3bb4b0abd109024d4e2389258ea64a89f54e4a4b88
Malware Config
Extracted
buer
https://maldivosgrant.net/
https://jokenoiam.net/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
networker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\"" networker.exe -
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
Processes:
resource yara_rule behavioral1/memory/112-1-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral1/memory/112-2-0x0000000040000000-0x000000004000C000-memory.dmp buer -
Executes dropped EXE 2 IoCs
Processes:
networker.exenetworker.exepid process 1836 networker.exe 1788 networker.exe -
Deletes itself 1 IoCs
Processes:
networker.exepid process 1788 networker.exe -
Loads dropped DLL 3 IoCs
Processes:
newbuer.exenewbuer.exenetworker.exepid process 288 newbuer.exe 112 newbuer.exe 1836 networker.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
networker.exedescription ioc process File opened (read-only) \??\M: networker.exe File opened (read-only) \??\P: networker.exe File opened (read-only) \??\T: networker.exe File opened (read-only) \??\U: networker.exe File opened (read-only) \??\W: networker.exe File opened (read-only) \??\V: networker.exe File opened (read-only) \??\Y: networker.exe File opened (read-only) \??\G: networker.exe File opened (read-only) \??\I: networker.exe File opened (read-only) \??\J: networker.exe File opened (read-only) \??\L: networker.exe File opened (read-only) \??\O: networker.exe File opened (read-only) \??\S: networker.exe File opened (read-only) \??\Z: networker.exe File opened (read-only) \??\B: networker.exe File opened (read-only) \??\H: networker.exe File opened (read-only) \??\K: networker.exe File opened (read-only) \??\Q: networker.exe File opened (read-only) \??\R: networker.exe File opened (read-only) \??\A: networker.exe File opened (read-only) \??\E: networker.exe File opened (read-only) \??\F: networker.exe File opened (read-only) \??\N: networker.exe File opened (read-only) \??\X: networker.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
newbuer.exenetworker.exedescription pid process target process PID 288 set thread context of 112 288 newbuer.exe newbuer.exe PID 1836 set thread context of 1788 1836 networker.exe networker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 8 IoCs
Processes:
resource yara_rule \ProgramData\RedTools\networker.exe nsis_installer_1 \ProgramData\RedTools\networker.exe nsis_installer_2 C:\ProgramData\RedTools\networker.exe nsis_installer_1 C:\ProgramData\RedTools\networker.exe nsis_installer_2 C:\ProgramData\RedTools\networker.exe nsis_installer_1 C:\ProgramData\RedTools\networker.exe nsis_installer_2 C:\ProgramData\RedTools\networker.exe nsis_installer_1 C:\ProgramData\RedTools\networker.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
networker.exepid process 1788 networker.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
newbuer.exenetworker.exepid process 288 newbuer.exe 1836 networker.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
newbuer.exenewbuer.exenetworker.exenetworker.exedescription pid process target process PID 288 wrote to memory of 112 288 newbuer.exe newbuer.exe PID 288 wrote to memory of 112 288 newbuer.exe newbuer.exe PID 288 wrote to memory of 112 288 newbuer.exe newbuer.exe PID 288 wrote to memory of 112 288 newbuer.exe newbuer.exe PID 288 wrote to memory of 112 288 newbuer.exe newbuer.exe PID 112 wrote to memory of 1836 112 newbuer.exe networker.exe PID 112 wrote to memory of 1836 112 newbuer.exe networker.exe PID 112 wrote to memory of 1836 112 newbuer.exe networker.exe PID 112 wrote to memory of 1836 112 newbuer.exe networker.exe PID 1836 wrote to memory of 1788 1836 networker.exe networker.exe PID 1836 wrote to memory of 1788 1836 networker.exe networker.exe PID 1836 wrote to memory of 1788 1836 networker.exe networker.exe PID 1836 wrote to memory of 1788 1836 networker.exe networker.exe PID 1836 wrote to memory of 1788 1836 networker.exe networker.exe PID 1788 wrote to memory of 1784 1788 networker.exe secinit.exe PID 1788 wrote to memory of 1784 1788 networker.exe secinit.exe PID 1788 wrote to memory of 1784 1788 networker.exe secinit.exe PID 1788 wrote to memory of 1784 1788 networker.exe secinit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\newbuer.exe"C:\Users\Admin\AppData\Local\Temp\newbuer.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\AppData\Local\Temp\newbuer.exe"C:\Users\Admin\AppData\Local\Temp\newbuer.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\newbuer.exe" ensgJJ3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\newbuer.exe" ensgJJ4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\RedTools\networker.exe5⤵PID:1784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4df84f8de8a5526f119c26518b529757
SHA142d281abeb10649bff097504f20e8fc2c8e85f5c
SHA2569e746625abad522321067f546c40e8b26176ef5585bf3a45cb58ff758738f68c
SHA51268cd6ce9eb7f01d7e6b2b2fff6dfdf981834168cb406a7d67df1f4c9d78b36b22689b03e408e3e68faf76d3bb4b0abd109024d4e2389258ea64a89f54e4a4b88
-
MD5
4df84f8de8a5526f119c26518b529757
SHA142d281abeb10649bff097504f20e8fc2c8e85f5c
SHA2569e746625abad522321067f546c40e8b26176ef5585bf3a45cb58ff758738f68c
SHA51268cd6ce9eb7f01d7e6b2b2fff6dfdf981834168cb406a7d67df1f4c9d78b36b22689b03e408e3e68faf76d3bb4b0abd109024d4e2389258ea64a89f54e4a4b88
-
MD5
4df84f8de8a5526f119c26518b529757
SHA142d281abeb10649bff097504f20e8fc2c8e85f5c
SHA2569e746625abad522321067f546c40e8b26176ef5585bf3a45cb58ff758738f68c
SHA51268cd6ce9eb7f01d7e6b2b2fff6dfdf981834168cb406a7d67df1f4c9d78b36b22689b03e408e3e68faf76d3bb4b0abd109024d4e2389258ea64a89f54e4a4b88
-
MD5
ba027a8a3a774d78ecd4919809951bfa
SHA11a0509011eeff5b96705f7ee330105965e6a2912
SHA2565eee8f9e5ca969cf58b38df6125d3666a59000f9f5ff24635e9d8b59d4debd96
SHA51232baa56e4935eb53a87604fdeae15d09c4da61d8d61e1429c2f63201cd6cfe194711b6690bae6984d414c71dc5917371caa5c92dc6be147e1f4d45557d06b9f8
-
MD5
4df84f8de8a5526f119c26518b529757
SHA142d281abeb10649bff097504f20e8fc2c8e85f5c
SHA2569e746625abad522321067f546c40e8b26176ef5585bf3a45cb58ff758738f68c
SHA51268cd6ce9eb7f01d7e6b2b2fff6dfdf981834168cb406a7d67df1f4c9d78b36b22689b03e408e3e68faf76d3bb4b0abd109024d4e2389258ea64a89f54e4a4b88
-
MD5
0063d48afe5a0cdc02833145667b6641
SHA1e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA256ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
SHA51271cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
-
MD5
0063d48afe5a0cdc02833145667b6641
SHA1e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA256ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
SHA51271cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0