buer | 8a90c1edcbd7e029d9cc42ffb7d50069e98585f8b17983074b0271575704cf49

Resubmissions

08/02/2021, 07:39

210208-vk216kedze 10

08/02/2021, 00:35

210208-f8eg4qhlga 10

Analysis

max time kernel
600s
max time network
601s
platform
windows10_x64
resource
win10v20201028
submitted
08/02/2021, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eci7g.bin.exe

Score

10^/10

buer raccoon fbb3ff62285b6085836cfe3d032d817936c927a9 loader stealer

Malware Config

Extracted

Family

buer

officewestunionbank.com

bankcreditsign.com

Extracted

Family

raccoon

Botnet

fbb3ff62285b6085836cfe3d032d817936c927a9

Attributes

url4cnc
https://telete.in/jvadikkamushkin

rc4.plain

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Buer Loader 2 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/508-3-0x0000000000030000-0x0000000000037000-memory.dmp	buer
behavioral1/memory/508-4-0x0000000040000000-0x0000000040009000-memory.dmp	buer

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	eci7g.bin.exe
File opened (read-only)	\??\B:	eci7g.bin.exe
File opened (read-only)	\??\Q:	eci7g.bin.exe
File opened (read-only)	\??\R:	eci7g.bin.exe
File opened (read-only)	\??\T:	eci7g.bin.exe
File opened (read-only)	\??\L:	eci7g.bin.exe
File opened (read-only)	\??\O:	eci7g.bin.exe
File opened (read-only)	\??\P:	eci7g.bin.exe
File opened (read-only)	\??\U:	eci7g.bin.exe
File opened (read-only)	\??\W:	eci7g.bin.exe
File opened (read-only)	\??\A:	eci7g.bin.exe
File opened (read-only)	\??\I:	eci7g.bin.exe
File opened (read-only)	\??\G:	eci7g.bin.exe
File opened (read-only)	\??\H:	eci7g.bin.exe
File opened (read-only)	\??\J:	eci7g.bin.exe
File opened (read-only)	\??\K:	eci7g.bin.exe
File opened (read-only)	\??\M:	eci7g.bin.exe
File opened (read-only)	\??\N:	eci7g.bin.exe
File opened (read-only)	\??\E:	eci7g.bin.exe
File opened (read-only)	\??\F:	eci7g.bin.exe
File opened (read-only)	\??\X:	eci7g.bin.exe
File opened (read-only)	\??\Z:	eci7g.bin.exe
File opened (read-only)	\??\S:	eci7g.bin.exe
File opened (read-only)	\??\V:	eci7g.bin.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 192	508	eci7g.bin.exe	78
PID 508 set thread context of 1280	508	eci7g.bin.exe	79

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 192	508	eci7g.bin.exe	78
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79
PID 508 wrote to memory of 1280	508	eci7g.bin.exe	79

C:\Users\Admin\AppData\Local\Temp\eci7g.bin.exe
"C:\Users\Admin\AppData\Local\Temp\eci7g.bin.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:192
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/192-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/508-2-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/508-3-0x0000000000030000-0x0000000000037000-memory.dmp

Filesize
28KB

Download
memory/508-4-0x0000000040000000-0x0000000040009000-memory.dmp

Filesize
36KB

Download
memory/1280-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads