Analysis
- max time kernel
1716s - max time network
1592s - platform
windows7_x64 - resource
win7v20201028 - submitted
18/12/2020, 09:25
General
- Target 3f28f4aebf8fa5fc27f5e3b72dac993f.exe
- Size 83KB
- Sample201218-s2dg893z32
- SHA256 146bcd0d720f43d289c66d3a3cdc77e5e5a3d924174ee1993ac6db2cb0ca8026
Score
10/10
Malware Config
Extracted
Family
-
buer
C2
-
softwareconsbank.com
Signatures
- Buer
Buer is a new modular loader first seen in August 2019.
- Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f28f4aebf8fa5fc27f5e3b72dac993f.exe"C:\Users\Admin\AppData\Local\Temp\3f28f4aebf8fa5fc27f5e3b72dac993f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f28f4aebf8fa5fc27f5e3b72dac993f.exe"C:\Users\Admin\AppData\Local\Temp\3f28f4aebf8fa5fc27f5e3b72dac993f.exe"2⤵
- Enumerates connected drives
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1752-3-0x0000000040000000-0x0000000040009000-memory.dmp
memory/1752-5-0x0000000040000000-0x0000000040009000-memory.dmp