Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:50
General
-
Target
9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe
-
Size
1.1MB
-
MD5
598b8633e7ca22ed1fb1f90d13215880
-
SHA1
01cd937912b153bad8bb9ee2c7314cb03b65fc5e
-
SHA256
9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96
-
SHA512
5899fdff91b6901363fad1f9b88f7150a264eba207f47819540af4576a44f03f64b267cf5dfb5b699d4b6955eda1708c18e59dbb5e66cbc3ac53b4849cddf601
Score
10/10
Malware Config
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Buer Loader 4 IoCs
Detects Buer loader in memory or disk.
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe"C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\RedTools\networker.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB