Analysis
-
max time kernel
88s -
max time network
110s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
23-09-2020 23:58
General
-
Target
Preview.exe
-
Size
577KB
-
MD5
50d70228e09abf06f3e7f41b9e1295cb
-
SHA1
9e3adaba7dc1092c610c8da7b27b11afc11ddc3d
-
SHA256
bee606dfb763d8d5a648fed649cfb1b8d5a62ac3143a3583634cccc305f26422
-
SHA512
57a6a7bca8c43e506b8c80f2c31a467ec519a6375a5dfbfa619034d832ad1c340db8fae1483be1fbafdb9e460996a2f6b381fa3bb3f9ea151cf7f87b9bc8ce52
Score
10/10
Malware Config
Extracted
Family
buer
C2
https://178.62.46.155/
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Preview.exe"C:\Users\Admin\AppData\Local\Temp\Preview.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\c960ed411bbc5376cd17}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
60KB