Analysis
- max time kernel
141s - max time network
140s - platform
windows7_x64 - resource
win7v200430 - submitted
06/07/2020, 07:30
General
- Target 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
- Size 38KB
- Sample200706-e9vg7tb8zn
- SHA256 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083
Score
10/10
Malware Config
Extracted
Family
-
buer
C2
-
https://66.228.45.248/
-
https://server-linode.nl/
Signatures
- Buer
Buer is a new modular loader first seen in August 2019.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Buer Loader 4 IoCs
Detects Buer loader in memory or disk.
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe"C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\d27b15bf5fed4179aa6c\gennt.exeC:\ProgramData\d27b15bf5fed4179aa6c\gennt.exe "C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\d27b15bf5fed4179aa6c\gennt.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\d27b15bf5fed4179aa6c}"3⤵
-
-