buer | 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124

General

Target

85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
Size

35KB
MD5

6f14c56f141d8eb8ccc58f6e3f341426
SHA1

70d9bc4ded0b7546ad7ee6d4873a5f5f58bc04e7
SHA256

85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124
SHA512

c91fb3355543beb3040ee4ef1287f1725f834279cc58786fe37fe0859612198b69e971c9910d379254018b51d0058749ae6199e28aec15d9ef5ce76fd3bbe5bd

Score

10^/10

Family

buer

C2

https://gstatiknetiplist.cc/

https://gstatiknetiplist.com/

Modifies WinLogon for persistence 2 TTPs 2 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\""	responder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\""	secinit.exe

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/files/0x000300000001a2df-1.dat	buer
behavioral2/files/0x000300000001a2df-2.dat	buer
behavioral2/memory/580-4-0x0000000000000000-mapping.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
732	responder.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
580	secinit.exe
580	secinit.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 732	1036	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	79
PID 1036 wrote to memory of 732	1036	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	79
PID 1036 wrote to memory of 732	1036	85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe	79
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80
PID 732 wrote to memory of 580	732	responder.exe	80

C:\Users\Admin\AppData\Local\Temp\85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
"C:\Users\Admin\AppData\Local\Temp\85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\ProgramData\ErrorResponder\responder.exe
  C:\ProgramData\ErrorResponder\responder.exe "C:\Users\Admin\AppData\Local\Temp\85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\ErrorResponder\responder.exe
    3⤵
    - Modifies WinLogon for persistence
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:580