buer | 045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee

General

Target

045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
Size

273KB
MD5

1ddd876da3731823324ffa302ddddcba
SHA1

2f6d73554c05dbda6cd738a2f38d5cdae2cdd4b7
SHA256

045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee
SHA512

88f453489949abdf85f733b746c7d1983ccd84d8c528840fdd749c207d97acb1ef3b87487e0f4eb3a9965450c51b3bf2230ad0dfff0b6c6b318b24b6c24911c5

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

shetylo-v1.com

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 1 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/1584-5-0x0000000040000000-0x000000004000A000-memory.dmp	buer

Loads dropped DLL 1 IoCs

pid	Process
1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\I:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\Q:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\V:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\E:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\F:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\M:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\W:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\X:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\S:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\U:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\B:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\J:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\K:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\L:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\O:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\T:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\Y:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\Z:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\A:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\H:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\N:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\P:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
File opened (read-only)	\??\R:	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 1584	1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1584	1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe	29
PID 1932 wrote to memory of 1584	1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe	29
PID 1932 wrote to memory of 1584	1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe	29
PID 1932 wrote to memory of 1584	1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe	29
PID 1932 wrote to memory of 1584	1932	045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe	29

C:\Users\Admin\AppData\Local\Temp\045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
"C:\Users\Admin\AppData\Local\Temp\045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe
  "C:\Users\Admin\AppData\Local\Temp\045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee.exe"
  2⤵
  - Enumerates connected drives
  PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-6-0x000007FEF5BC0000-0x000007FEF5E3A000-memory.dmp

Filesize
2.5MB

Download
memory/1584-5-0x0000000040000000-0x000000004000A000-memory.dmp

Filesize
40KB

Download
memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing