buer | c69a9adf7333a5098d91be899802e6f0e77de4d1be8d11363dccd0fc830311c5

General

Target

ken.exe
Size

228KB
MD5

14e0e1a26f0e29171486cb2feb89fc3e
SHA1

cb3f2b4e3f5060088c6158f4b6c5b6d627f68a20
SHA256

c69a9adf7333a5098d91be899802e6f0e77de4d1be8d11363dccd0fc830311c5
SHA512

12ea8bb6bdcc809a2ba46a33cb69e4535af3a5ba9750179cf1a8f050ae1e3f0ea544000d504a2318c8d22e297eaa466f7977c593f3d00ec2c24276e66abd8430

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

C2

https://rawcookies.ru/

https://westkingz.ru/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\92c31ebae0ab671de163\\gennt.exe\""	gennt.exe

Buer Loader 4 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/memory/3820-0-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral2/memory/3820-1-0x0000000040003030-mapping.dmp	buer
behavioral2/memory/3820-2-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral2/memory/568-7-0x0000000040003030-mapping.dmp	buer

Executes dropped EXE 2 IoCs

pid	Process
3708	gennt.exe
568	gennt.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 3820	3888	ken.exe	67
PID 3708 set thread context of 568	3708	gennt.exe	75

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	ken.exe
Token: SeDebugPrivilege	3708	gennt.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3888 wrote to memory of 3820	3888	ken.exe	67
PID 3820 wrote to memory of 3708	3820	ken.exe	74
PID 3820 wrote to memory of 3708	3820	ken.exe	74
PID 3820 wrote to memory of 3708	3820	ken.exe	74
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 3708 wrote to memory of 568	3708	gennt.exe	75
PID 568 wrote to memory of 836	568	gennt.exe	76
PID 568 wrote to memory of 836	568	gennt.exe	76
PID 568 wrote to memory of 836	568	gennt.exe	76

C:\Users\Admin\AppData\Local\Temp\ken.exe
"C:\Users\Admin\AppData\Local\Temp\ken.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Temp\ken.exe
  C:\Users\Admin\AppData\Local\Temp\ken.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\ProgramData\92c31ebae0ab671de163\gennt.exe
    C:\ProgramData\92c31ebae0ab671de163\gennt.exe "C:\Users\Admin\AppData\Local\Temp\ken.exe" ensgJJ
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\ProgramData\92c31ebae0ab671de163\gennt.exe
      C:\ProgramData\92c31ebae0ab671de163\gennt.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Windows\SysWOW64\secinit.exe
        
        C:\ProgramData\92c31ebae0ab671de163\gennt.exe
        5⤵
        
        PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-0-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/3820-2-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing