buer | 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083

General

Target

070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
Size

38KB
MD5

d91043ee270758fbc29613e993cf17a6
SHA1

bf3baf3e2d446f65b14d310e0e0a79d4002f9c03
SHA256

070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083
SHA512

1b8daad67e37e02835666acb1a815baccd235f955c95cf34bb28a9f4301eae32767919c1a473614da61ff7c0c0e646ac04317145228d6c57f02f3a0e55535000

Score

10^/10

Family

buer

C2

https://66.228.45.248/

https://server-linode.nl/

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\d27b15bf5fed4179aa6c\\gennt.exe\""	gennt.exe

Buer Loader 4 IoCs

Detects Buer loader in memory or disk.

Executes dropped EXE 1 IoCs

pid	Process
1828	gennt.exe

Deletes itself 1 IoCs

pid	Process
1828	gennt.exe

Loads dropped DLL 2 IoCs

pid	Process
1528	070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
1528	070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1828	gennt.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1828	1528	070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe	26
PID 1528 wrote to memory of 1828	1528	070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe	26
PID 1528 wrote to memory of 1828	1528	070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe	26
PID 1528 wrote to memory of 1828	1528	070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe	26
PID 1828 wrote to memory of 1836	1828	gennt.exe	27
PID 1828 wrote to memory of 1836	1828	gennt.exe	27
PID 1828 wrote to memory of 1836	1828	gennt.exe	27
PID 1828 wrote to memory of 1836	1828	gennt.exe	27
PID 1828 wrote to memory of 1868	1828	gennt.exe	28
PID 1828 wrote to memory of 1868	1828	gennt.exe	28
PID 1828 wrote to memory of 1868	1828	gennt.exe	28
PID 1828 wrote to memory of 1868	1828	gennt.exe	28