buer | 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124

General

Target

85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
Size

35KB
MD5

6f14c56f141d8eb8ccc58f6e3f341426
SHA1

70d9bc4ded0b7546ad7ee6d4873a5f5f58bc04e7
SHA256

85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124
SHA512

c91fb3355543beb3040ee4ef1287f1725f834279cc58786fe37fe0859612198b69e971c9910d379254018b51d0058749ae6199e28aec15d9ef5ce76fd3bbe5bd

Score

10^/10

Family

buer

C2

https://gstatiknetiplist.cc/

https://gstatiknetiplist.com/

Modifies WinLogon for persistence 2 TTPs 2 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\""	responder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\""	secinit.exe

Buer Loader 5 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/files/0x000d00000000560a-0.dat	buer
behavioral1/files/0x000d00000000560a-1.dat	buer
behavioral1/files/0x000d00000000560a-3.dat	buer
behavioral1/files/0x000d00000000560a-4.dat	buer
behavioral1/memory/1436-6-0x0000000000000000-mapping.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
1696	responder.exe

Deletes itself 1 IoCs

pid	Process
1696	responder.exe

Loads dropped DLL 2 IoCs

pid	Process
1632	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
1632	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1436	secinit.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1696	1632	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	29
PID 1632 wrote to memory of 1696	1632	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	29
PID 1632 wrote to memory of 1696	1632	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	29
PID 1632 wrote to memory of 1696	1632	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	29
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30
PID 1696 wrote to memory of 1436	1696	responder.exe	30