buer | 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7

Analysis

max time kernel
114s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
01-02-2022 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe
Size

96KB
MD5

47c011a8f2bab4077182cff452c36608
SHA1

edbeed7e8b4f56502bd600d8770e786936e8e8d0
SHA256

45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7
SHA512

2531647ab6aebf1c7d714225f3a724b875852ff9cf461eeb6be27ea6d7251f332edc2b2b1ce6907c6fa2f00a0e83c3f7ea27ea02f5c824f0dcd6efb313aa2e01

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

https://mesoplano.com/

https://banusle.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e6f27a2fefcd169ca157\\gennt.exe\""	gennt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e6f27a2fefcd169ca157\\gennt.exe\""	secinit.exe

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/memory/2288-133-0x0000000000A20000-0x0000000000A2C000-memory.dmp	buer
behavioral2/memory/3824-135-0x00000000008C0000-0x00000000008CC000-memory.dmp	buer
behavioral2/memory/848-141-0x00000000030F0000-0x00000000030FC000-memory.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
3824	gennt.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	secinit.exe
File opened (read-only)	\??\K:	secinit.exe
File opened (read-only)	\??\L:	secinit.exe
File opened (read-only)	\??\P:	secinit.exe
File opened (read-only)	\??\Z:	secinit.exe
File opened (read-only)	\??\A:	secinit.exe
File opened (read-only)	\??\R:	secinit.exe
File opened (read-only)	\??\W:	secinit.exe
File opened (read-only)	\??\F:	secinit.exe
File opened (read-only)	\??\G:	secinit.exe
File opened (read-only)	\??\H:	secinit.exe
File opened (read-only)	\??\I:	secinit.exe
File opened (read-only)	\??\M:	secinit.exe
File opened (read-only)	\??\N:	secinit.exe
File opened (read-only)	\??\O:	secinit.exe
File opened (read-only)	\??\S:	secinit.exe
File opened (read-only)	\??\B:	secinit.exe
File opened (read-only)	\??\Y:	secinit.exe
File opened (read-only)	\??\V:	secinit.exe
File opened (read-only)	\??\Q:	secinit.exe
File opened (read-only)	\??\T:	secinit.exe
File opened (read-only)	\??\U:	secinit.exe
File opened (read-only)	\??\X:	secinit.exe
File opened (read-only)	\??\J:	secinit.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
848	secinit.exe
848	secinit.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3824	2288	45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe	64
PID 2288 wrote to memory of 3824	2288	45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe	64
PID 2288 wrote to memory of 3824	2288	45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe	64
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 3824 wrote to memory of 848	3824	gennt.exe	65
PID 848 wrote to memory of 3212	848	secinit.exe	70
PID 848 wrote to memory of 3212	848	secinit.exe	70
PID 848 wrote to memory of 3212	848	secinit.exe	70

C:\Users\Admin\AppData\Local\Temp\45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe
"C:\Users\Admin\AppData\Local\Temp\45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\ProgramData\e6f27a2fefcd169ca157\gennt.exe
  C:\ProgramData\e6f27a2fefcd169ca157\gennt.exe "C:\Users\Admin\AppData\Local\Temp\45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\e6f27a2fefcd169ca157\gennt.exe
    3⤵
    - Modifies WinLogon for persistence
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\e6f27a2fefcd169ca157}"
      4⤵
      PID:3212

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 61c1df13761ac1fc0cd8c20e8b85972c OCc6KrGzrkeGdk/2fP5osg.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-136-0x0000000002B50000-0x0000000002B77000-memory.dmp

Filesize
156KB

Download
memory/848-138-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/848-140-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download
memory/848-139-0x0000000002B50000-0x0000000002B77000-memory.dmp

Filesize
156KB

Download
memory/848-141-0x00000000030F0000-0x00000000030FC000-memory.dmp

Filesize
48KB

Download
memory/2288-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2288-133-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Filesize
48KB

Download
memory/3824-135-0x00000000008C0000-0x00000000008CC000-memory.dmp

Filesize
48KB

Download
memory/3824-134-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/3824-137-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download