buer | 615b9395be665d265953e69924b4df1808eda0fd40381d6d469bf4c362590125

General

Target

b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe
Size

1.1MB
MD5

b5ffd4ecdf7f1d4eb5f13a7207c5e4a5
SHA1

145b3ed98ffe2ca15172dcabf52a76ecd33bd657
SHA256

615b9395be665d265953e69924b4df1808eda0fd40381d6d469bf4c362590125
SHA512

8e918bc2304f7e761736d2c03494bf278c854fdfb30ec7d7459fd1cfbcdd88c279396d55d0d8954389d742d6e3f46b99bb93dbce3137c26d1ca95e3ee8c93ea3

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\""	networker.exe

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/files/0x000300000001a2df-1.dat	buer
behavioral2/files/0x000300000001a2df-2.dat	buer
behavioral2/memory/3436-4-0x0000000000000000-mapping.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
3852	networker.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/files/0x000300000001a2df-1.dat	vmprotect
behavioral2/files/0x000300000001a2df-2.dat	vmprotect

Deletes itself 1 IoCs

pid	Process
3852	networker.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	networker.exe
3852	networker.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3852	4764	b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe	79
PID 4764 wrote to memory of 3852	4764	b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe	79
PID 4764 wrote to memory of 3852	4764	b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe	79
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80
PID 3852 wrote to memory of 3436	3852	networker.exe	80

C:\Users\Admin\AppData\Local\Temp\b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe
"C:\Users\Admin\AppData\Local\Temp\b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\ProgramData\RedTools\networker.exe
  C:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Deletes itself
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\RedTools\networker.exe
    3⤵
    PID:3436