buer | a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0

General

Target

a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe
Size

259KB
MD5

ac8348dd8319365d4857b1e20715c6da
SHA1

5c5b1008a7a96015f2588fd60ddc0b4739f74fb5
SHA256

a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0
SHA512

eed7640b28d4b023cd4c252ed812820221aca61f969ca2e6d5f59aad5532fae07d17401272dd36a3c49641136fa8a95d1e1d801076deb8eac97222f506f0ac86

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

https://kackdelar.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/memory/3248-6-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral2/memory/3248-7-0x0000000040002E00-mapping.dmp	buer
behavioral2/memory/3248-8-0x0000000040000000-0x000000004000C000-memory.dmp	buer

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	RegAsm.exe
File opened (read-only)	\??\F:	RegAsm.exe
File opened (read-only)	\??\G:	RegAsm.exe
File opened (read-only)	\??\K:	RegAsm.exe
File opened (read-only)	\??\L:	RegAsm.exe
File opened (read-only)	\??\U:	RegAsm.exe
File opened (read-only)	\??\A:	RegAsm.exe
File opened (read-only)	\??\H:	RegAsm.exe
File opened (read-only)	\??\O:	RegAsm.exe
File opened (read-only)	\??\S:	RegAsm.exe
File opened (read-only)	\??\T:	RegAsm.exe
File opened (read-only)	\??\V:	RegAsm.exe
File opened (read-only)	\??\Y:	RegAsm.exe
File opened (read-only)	\??\Z:	RegAsm.exe
File opened (read-only)	\??\P:	RegAsm.exe
File opened (read-only)	\??\R:	RegAsm.exe
File opened (read-only)	\??\W:	RegAsm.exe
File opened (read-only)	\??\E:	RegAsm.exe
File opened (read-only)	\??\I:	RegAsm.exe
File opened (read-only)	\??\J:	RegAsm.exe
File opened (read-only)	\??\M:	RegAsm.exe
File opened (read-only)	\??\N:	RegAsm.exe
File opened (read-only)	\??\Q:	RegAsm.exe
File opened (read-only)	\??\X:	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3876 set thread context of 3248	3876	a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe	72

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe
3248	RegAsm.exe
3248	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3876	a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3248	3876	a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe	72
PID 3876 wrote to memory of 3248	3876	a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe	72
PID 3876 wrote to memory of 3248	3876	a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe	72
PID 3876 wrote to memory of 3248	3876	a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe	72
PID 3248 wrote to memory of 3748	3248	RegAsm.exe	76
PID 3248 wrote to memory of 3748	3248	RegAsm.exe	76
PID 3248 wrote to memory of 3748	3248	RegAsm.exe	76

C:\Users\Admin\AppData\Local\Temp\a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe
"C:\Users\Admin\AppData\Local\Temp\a6cf85f38f11e82be3fbabc2f7ee0d07f608f30ceb92654ec2168c4fcfad56e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\563b80623112110d8474}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3248-6-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/3248-8-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/3748-14-0x0000000007930000-0x0000000007931000-memory.dmp

Filesize
4KB

Download
memory/3748-16-0x0000000007BF0000-0x0000000007BF1000-memory.dmp

Filesize
4KB

Download
memory/3748-33-0x0000000009560000-0x0000000009561000-memory.dmp

Filesize
4KB

Download
memory/3748-31-0x0000000009570000-0x0000000009571000-memory.dmp

Filesize
4KB

Download
memory/3748-10-0x00000000733A0000-0x0000000073A8E000-memory.dmp

Filesize
6.9MB

Download
memory/3748-11-0x0000000006B40000-0x0000000006B41000-memory.dmp

Filesize
4KB

Download
memory/3748-12-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/3748-13-0x0000000007890000-0x0000000007891000-memory.dmp

Filesize
4KB

Download
memory/3748-30-0x00000000095D0000-0x00000000095D1000-memory.dmp

Filesize
4KB

Download
memory/3748-15-0x00000000079A0000-0x00000000079A1000-memory.dmp

Filesize
4KB

Download
memory/3748-29-0x0000000009200000-0x0000000009201000-memory.dmp

Filesize
4KB

Download
memory/3748-17-0x0000000008000000-0x0000000008001000-memory.dmp

Filesize
4KB

Download
memory/3748-18-0x0000000008510000-0x0000000008511000-memory.dmp

Filesize
4KB

Download
memory/3748-19-0x0000000008310000-0x0000000008311000-memory.dmp

Filesize
4KB

Download
memory/3748-21-0x00000000090B0000-0x00000000090E3000-memory.dmp

Filesize
204KB

Download
memory/3748-28-0x0000000009090000-0x0000000009091000-memory.dmp

Filesize
4KB

Download
memory/3876-4-0x0000000004AE0000-0x0000000004AF1000-memory.dmp

Filesize
68KB

Download
memory/3876-0-0x0000000073530000-0x0000000073C1E000-memory.dmp

Filesize
6.9MB

Download
memory/3876-1-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/3876-3-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing