Analysis
- max time kernel
62s - max time network
112s - platform
windows10_x64 - resource
win10v200722 - submitted
03/10/2020, 10:06
General
- Target fdafeff.exe
- Size 362KB
- Sample201003-wd7endd13e
- SHA256 cf91ba98b1c8faba7f89257452b72656f810063ba402a1d5e815a881ec43418f
Malware Config
Signatures
- Buer
Buer is a new modular loader first seen in August 2019.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdafeff.exe"C:\Users\Admin\AppData\Local\Temp\fdafeff.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\1de8e1c12c093f673504}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2308-1-0x0000000073180000-0x000000007386E000-memory.dmp
memory/2308-2-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/2308-3-0x0000000007AC0000-0x0000000007AC1000-memory.dmp
memory/2308-4-0x0000000007900000-0x0000000007901000-memory.dmp
memory/2308-5-0x00000000080F0000-0x00000000080F1000-memory.dmp
memory/2308-6-0x00000000083B0000-0x00000000083B1000-memory.dmp
memory/2308-7-0x0000000008420000-0x0000000008421000-memory.dmp
memory/2308-8-0x00000000081D0000-0x00000000081D1000-memory.dmp
memory/2308-9-0x0000000008C10000-0x0000000008C11000-memory.dmp
memory/2308-10-0x0000000008AD0000-0x0000000008AD1000-memory.dmp
memory/2308-12-0x0000000009850000-0x0000000009883000-memory.dmp
memory/2308-19-0x0000000009830000-0x0000000009831000-memory.dmp
memory/2308-20-0x0000000009BD0000-0x0000000009BD1000-memory.dmp
memory/2308-21-0x0000000009DE0000-0x0000000009DE1000-memory.dmp
memory/2308-22-0x0000000009D40000-0x0000000009D41000-memory.dmp
memory/2308-24-0x0000000009D10000-0x0000000009D11000-memory.dmp