buer | 9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96

General

Target

9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe
Size

1.1MB
MD5

598b8633e7ca22ed1fb1f90d13215880
SHA1

01cd937912b153bad8bb9ee2c7314cb03b65fc5e
SHA256

9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96
SHA512

5899fdff91b6901363fad1f9b88f7150a264eba207f47819540af4576a44f03f64b267cf5dfb5b699d4b6955eda1708c18e59dbb5e66cbc3ac53b4849cddf601

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\""	networker.exe

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/files/0x000300000001a0e3-1.dat	buer
behavioral2/files/0x000300000001a0e3-2.dat	buer
behavioral2/memory/3684-4-0x0000000000000000-mapping.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
3640	networker.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/files/0x000300000001a0e3-1.dat	vmprotect
behavioral2/files/0x000300000001a0e3-2.dat	vmprotect

Deletes itself 1 IoCs

pid	Process
3640	networker.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3640	networker.exe
3640	networker.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3640	984	9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe	78
PID 984 wrote to memory of 3640	984	9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe	78
PID 984 wrote to memory of 3640	984	9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe	78
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79
PID 3640 wrote to memory of 3684	3640	networker.exe	79

C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe
"C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\ProgramData\RedTools\networker.exe
  C:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\9f5b423a9328974ee01c625ab5338e698fa19f711c233ba941489eb802dadc96.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Deletes itself
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\RedTools\networker.exe
    3⤵
    PID:3684