Analysis
-
max time kernel
63s -
max time network
110s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
02-10-2020 16:45
Static task
static1
Behavioral task
behavioral1
Sample
Report_Print.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
Report_Print.exe
-
Size
627KB
-
MD5
935c24fca50f8ac28c040a8c3823df13
-
SHA1
c7a6e7ace50c47e1d3a54ffd50dbdab26ddcf4ce
-
SHA256
611ebfdce09ab9d4966796e03fbe0a6e9bc4f6e4a8f81d941d0a5b39c0bab6ff
-
SHA512
ee2f7213d4ce85865f947d9b6f5ded3535f6337c12f5141cb6ed58d48c20b257a613799e29fd9f5e5c7706d3d38f9e93119752dc3726e0d71b5dcc233fc4fec9
Malware Config
Extracted
Family
buer
C2
https://bankcreditsign.com/
Signatures
-
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/memory/3740-0-0x0000000000750000-0x00000000007B0000-memory.dmp buer behavioral2/memory/3740-1-0x0000000040000000-0x000000004005D000-memory.dmp buer -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Report_Print.exe File opened (read-only) \??\N: Report_Print.exe File opened (read-only) \??\Q: Report_Print.exe File opened (read-only) \??\V: Report_Print.exe File opened (read-only) \??\Y: Report_Print.exe File opened (read-only) \??\B: Report_Print.exe File opened (read-only) \??\F: Report_Print.exe File opened (read-only) \??\G: Report_Print.exe File opened (read-only) \??\R: Report_Print.exe File opened (read-only) \??\U: Report_Print.exe File opened (read-only) \??\Z: Report_Print.exe File opened (read-only) \??\A: Report_Print.exe File opened (read-only) \??\I: Report_Print.exe File opened (read-only) \??\J: Report_Print.exe File opened (read-only) \??\P: Report_Print.exe File opened (read-only) \??\S: Report_Print.exe File opened (read-only) \??\T: Report_Print.exe File opened (read-only) \??\W: Report_Print.exe File opened (read-only) \??\X: Report_Print.exe File opened (read-only) \??\E: Report_Print.exe File opened (read-only) \??\L: Report_Print.exe File opened (read-only) \??\M: Report_Print.exe File opened (read-only) \??\H: Report_Print.exe File opened (read-only) \??\O: Report_Print.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1868 powershell.exe 1868 powershell.exe 1868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1868 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3740 wrote to memory of 1868 3740 Report_Print.exe 72 PID 3740 wrote to memory of 1868 3740 Report_Print.exe 72 PID 3740 wrote to memory of 1868 3740 Report_Print.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\Report_Print.exe"C:\Users\Admin\AppData\Local\Temp\Report_Print.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\91080b59cc6f4653c682}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
-