Analysis

  • max time kernel
    135s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-11-2020 19:38

General

  • Target

    buer.exe

  • Size

    111KB

  • MD5

    f884618092b55e3edc48096757aab143

  • SHA1

    0c0ad1301fc561699dba22cc779decc0df5570a1

  • SHA256

    6728db086194c2fa6a8e17e7b13bac1f5329b501e6f93b3587416895d387d343

  • SHA512

    195f4995907e34867d72778fb7e5857ea16e802376cf7ef17e2af3afa64e929bacfed4ed1b60d71a1ad8ea29e47c795c97ee7e41b6a02db59c9cc68fbb32e6ad

Score
10/10

Malware Config

Extracted

Family

buer

C2

https://oopscll5.top/

https://1raidertr.top/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Buer Loader 4 IoCs

    Detects Buer loader in memory or disk.

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 8 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\buer.exe
    "C:\Users\Admin\AppData\Local\Temp\buer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\AppData\Local\Temp\buer.exe
      "C:\Users\Admin\AppData\Local\Temp\buer.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\ProgramData\ErrorResponder\errorResponder.exe
        C:\ProgramData\ErrorResponder\errorResponder.exe "C:\Users\Admin\AppData\Local\Temp\buer.exe" ensgJJ
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\ProgramData\ErrorResponder\errorResponder.exe
          C:\ProgramData\ErrorResponder\errorResponder.exe "C:\Users\Admin\AppData\Local\Temp\buer.exe" ensgJJ
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Windows\SysWOW64\secinit.exe
            C:\ProgramData\ErrorResponder\errorResponder.exe
            5⤵
              PID:428

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1648-1-0x0000000040000000-0x000000004000B000-memory.dmp

      Filesize

      44KB

    • memory/1648-3-0x0000000040000000-0x000000004000B000-memory.dmp

      Filesize

      44KB