Analysis
-
max time kernel
116s -
max time network
77s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
23-09-2020 06:28
Static task
static1
Behavioral task
behavioral1
Sample
67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe
-
Size
239KB
-
MD5
f447d7a2f7cfb24db6b3c42716b16457
-
SHA1
6c898d8bc1b2311859b34df36e0ba9c392a30b9f
-
SHA256
67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247
-
SHA512
b303f0d106ce5fadda89346e78516ca8251dd532f1efa2540085b665d9de6dbba03c77bdc7007294a893f62a5e1fe22790513b97261eb6ba4eed1aac4d870e1a
Malware Config
Extracted
Family
buer
C2
https://104.248.83.13/
Signatures
-
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/memory/728-0-0x0000000000650000-0x000000000065F000-memory.dmp buer behavioral2/memory/728-1-0x0000000040000000-0x000000004000C000-memory.dmp buer -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\S: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\U: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\V: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\A: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\B: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\M: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\N: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\X: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\Y: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\O: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\Q: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\T: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\W: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\G: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\I: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\K: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\L: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\R: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\Z: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\E: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\F: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\H: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe File opened (read-only) \??\J: 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1792 powershell.exe 1792 powershell.exe 1792 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1792 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 728 wrote to memory of 1792 728 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe 76 PID 728 wrote to memory of 1792 728 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe 76 PID 728 wrote to memory of 1792 728 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe"C:\Users\Admin\AppData\Local\Temp\67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\13367dad19b34959fa2d}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-