buer | 522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f

General

Target

522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe
Size

277KB
MD5

87458f08d1c715853dfcbdc7510566be
SHA1

7b1a5d9bb21d852a6dbf3146fabb1cd1ca276ed9
SHA256

522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f
SHA512

ed91a9a42c494076d5a57bde8d8c3247e8fa1bcf85af8e36e304d9dfd00223b2f4f306c1b3474d3afe7d6b2f9f77dc7b579d3d7b96770699d88e947dc2c685c3

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

C2

https://cloudupdates.co.za/

https:///securitycloudserver.co.za/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\MiscTools\\responder.exe\""	responder.exe

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/1612-55-0x0000000000220000-0x000000000022A000-memory.dmp	buer
behavioral1/memory/1612-56-0x0000000040000000-0x00000000400B1000-memory.dmp	buer
behavioral1/memory/1340-63-0x0000000040000000-0x00000000400B1000-memory.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
1340	responder.exe

Deletes itself 1 IoCs

pid	Process
1340	responder.exe

Loads dropped DLL 2 IoCs

pid	Process
1612	522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe
1612	522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	responder.exe
File opened (read-only)	\??\S:	responder.exe
File opened (read-only)	\??\T:	responder.exe
File opened (read-only)	\??\Z:	responder.exe
File opened (read-only)	\??\R:	responder.exe
File opened (read-only)	\??\U:	responder.exe
File opened (read-only)	\??\A:	responder.exe
File opened (read-only)	\??\E:	responder.exe
File opened (read-only)	\??\I:	responder.exe
File opened (read-only)	\??\P:	responder.exe
File opened (read-only)	\??\O:	responder.exe
File opened (read-only)	\??\V:	responder.exe
File opened (read-only)	\??\X:	responder.exe
File opened (read-only)	\??\Y:	responder.exe
File opened (read-only)	\??\G:	responder.exe
File opened (read-only)	\??\K:	responder.exe
File opened (read-only)	\??\L:	responder.exe
File opened (read-only)	\??\M:	responder.exe
File opened (read-only)	\??\Q:	responder.exe
File opened (read-only)	\??\W:	responder.exe
File opened (read-only)	\??\B:	responder.exe
File opened (read-only)	\??\F:	responder.exe
File opened (read-only)	\??\J:	responder.exe
File opened (read-only)	\??\N:	responder.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	1620	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1340	responder.exe
964	WerFault.exe
964	WerFault.exe
964	WerFault.exe
964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1340	1612	522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe	27
PID 1612 wrote to memory of 1340	1612	522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe	27
PID 1612 wrote to memory of 1340	1612	522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe	27
PID 1612 wrote to memory of 1340	1612	522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe	27
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1340 wrote to memory of 1620	1340	responder.exe	28
PID 1620 wrote to memory of 964	1620	secinit.exe	31
PID 1620 wrote to memory of 964	1620	secinit.exe	31
PID 1620 wrote to memory of 964	1620	secinit.exe	31
PID 1620 wrote to memory of 964	1620	secinit.exe	31

C:\Users\Admin\AppData\Local\Temp\522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe
"C:\Users\Admin\AppData\Local\Temp\522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612
- C:\ProgramData\MiscTools\responder.exe
  C:\ProgramData\MiscTools\responder.exe "C:\Users\Admin\AppData\Local\Temp\522a42c27449aba54fa539f28082f1ddc2e8e6ea4f3dd29141f702a5ad82e29f.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Deletes itself
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\MiscTools\responder.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 136
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-74-0x00000000001B0000-0x0000000000210000-memory.dmp

Filesize
384KB

Download
memory/1340-60-0x00000000004F0000-0x0000000000514000-memory.dmp

Filesize
144KB

Download
memory/1340-63-0x0000000040000000-0x00000000400B1000-memory.dmp

Filesize
708KB

Download
memory/1612-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/1612-56-0x0000000040000000-0x00000000400B1000-memory.dmp

Filesize
708KB

Download
memory/1612-53-0x0000000000350000-0x0000000000374000-memory.dmp

Filesize
144KB

Download
memory/1620-64-0x00000000000D0000-0x0000000000181000-memory.dmp

Filesize
708KB

Download
memory/1620-67-0x00000000000D0000-0x0000000000181000-memory.dmp

Filesize
708KB

Download
memory/1620-66-0x00000000000D0000-0x0000000000181000-memory.dmp

Filesize
708KB

Download
memory/1620-69-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1620-70-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1620-68-0x00000000000D0000-0x0000000000181000-memory.dmp

Filesize
708KB

Download
memory/1620-71-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1620-72-0x00000000000D0000-0x0000000000181000-memory.dmp

Filesize
708KB

Download
memory/1620-65-0x00000000000D0000-0x0000000000181000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing