Analysis
- max time kernel
103s - max time network
113s - platform
windows10_x64 - resource
win10v200722 - submitted
16/09/2020, 16:43
General
- Target a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe
- Size 259KB
- Sample200916-m16pqq2vx2
- SHA256 a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0
Malware Config
Extracted
-
buer
-
https://kackdelar.top/
Signatures
- Buer
Buer is a new modular loader first seen in August 2019.
- Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe"C:\Users\Admin\AppData\Local\Temp\a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\563b80623112110d8474}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3248-6-0x0000000040000000-0x000000004000C000-memory.dmp
memory/3248-8-0x0000000040000000-0x000000004000C000-memory.dmp
memory/3748-14-0x0000000007930000-0x0000000007931000-memory.dmp
memory/3748-16-0x0000000007BF0000-0x0000000007BF1000-memory.dmp
memory/3748-33-0x0000000009560000-0x0000000009561000-memory.dmp
memory/3748-31-0x0000000009570000-0x0000000009571000-memory.dmp
memory/3748-10-0x00000000733A0000-0x0000000073A8E000-memory.dmp
memory/3748-11-0x0000000006B40000-0x0000000006B41000-memory.dmp
memory/3748-12-0x0000000007210000-0x0000000007211000-memory.dmp
memory/3748-13-0x0000000007890000-0x0000000007891000-memory.dmp
memory/3748-30-0x00000000095D0000-0x00000000095D1000-memory.dmp
memory/3748-15-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/3748-29-0x0000000009200000-0x0000000009201000-memory.dmp
memory/3748-17-0x0000000008000000-0x0000000008001000-memory.dmp
memory/3748-18-0x0000000008510000-0x0000000008511000-memory.dmp
memory/3748-19-0x0000000008310000-0x0000000008311000-memory.dmp
memory/3748-21-0x00000000090B0000-0x00000000090E3000-memory.dmp
memory/3748-28-0x0000000009090000-0x0000000009091000-memory.dmp
memory/3876-4-0x0000000004AE0000-0x0000000004AF1000-memory.dmp
memory/3876-0-0x0000000073530000-0x0000000073C1E000-memory.dmp
memory/3876-1-0x0000000000040000-0x0000000000041000-memory.dmp
memory/3876-3-0x0000000004920000-0x0000000004921000-memory.dmp