buer | 68a83d0a3bfcd1bcebf35eeba2bd778b2b64516f73cb2932ad9e6e4667dd9781

General

Target

update-recharge.exe
Size

353KB
MD5

c1b6185f5ba6a3d5c4e1017b1b684492
SHA1

005ab0f0d9ec20c7dbb4512489f17bcb7494fe0e
SHA256

68a83d0a3bfcd1bcebf35eeba2bd778b2b64516f73cb2932ad9e6e4667dd9781
SHA512

23766708489576355d3e2893f59ef1179cc3bbf6379a48709f7bd3bd8aa9bc7bd2d527983f5d8fa23cf7e4a114f8f9c65882b949133b027b4be97e4d05a44dc4

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

https://kackdelar.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/1568-5-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral1/memory/1568-6-0x0000000040002E38-mapping.dmp	buer
behavioral1/memory/1568-7-0x0000000040000000-0x000000004000C000-memory.dmp	buer

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	update-recharge.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	RegAsm.exe
File opened (read-only)	\??\V:	RegAsm.exe
File opened (read-only)	\??\W:	RegAsm.exe
File opened (read-only)	\??\A:	RegAsm.exe
File opened (read-only)	\??\E:	RegAsm.exe
File opened (read-only)	\??\O:	RegAsm.exe
File opened (read-only)	\??\P:	RegAsm.exe
File opened (read-only)	\??\Q:	RegAsm.exe
File opened (read-only)	\??\U:	RegAsm.exe
File opened (read-only)	\??\F:	RegAsm.exe
File opened (read-only)	\??\I:	RegAsm.exe
File opened (read-only)	\??\J:	RegAsm.exe
File opened (read-only)	\??\K:	RegAsm.exe
File opened (read-only)	\??\T:	RegAsm.exe
File opened (read-only)	\??\Y:	RegAsm.exe
File opened (read-only)	\??\Z:	RegAsm.exe
File opened (read-only)	\??\B:	RegAsm.exe
File opened (read-only)	\??\H:	RegAsm.exe
File opened (read-only)	\??\L:	RegAsm.exe
File opened (read-only)	\??\R:	RegAsm.exe
File opened (read-only)	\??\X:	RegAsm.exe
File opened (read-only)	\??\G:	RegAsm.exe
File opened (read-only)	\??\M:	RegAsm.exe
File opened (read-only)	\??\N:	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 896 set thread context of 1568	896	update-recharge.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	powershell.exe
2020	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
896	update-recharge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 896 wrote to memory of 1568	896	update-recharge.exe	28
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29
PID 1568 wrote to memory of 2020	1568	RegAsm.exe	29

C:\Users\Admin\AppData\Local\Temp\update-recharge.exe
"C:\Users\Admin\AppData\Local\Temp\update-recharge.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\c586a117efff54465c0a}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-0-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/896-1-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/896-3-0x00000000008F0000-0x0000000000901000-memory.dmp

Filesize
68KB

Download
memory/1568-5-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/1568-7-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2020-9-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/2020-10-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/2020-11-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/2020-12-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/2020-13-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/2020-16-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/2020-21-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/2020-22-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/2020-29-0x0000000006320000-0x0000000006321000-memory.dmp

Filesize
4KB

Download
memory/2020-30-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/2020-44-0x00000000063E0000-0x00000000063E1000-memory.dmp

Filesize
4KB

Download
memory/2020-45-0x00000000063F0000-0x00000000063F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing