buer | 7203a338d66ac5456e265ed210c09b7c28ec6bd50d46d48c8d38fe14846f834f

General

Target

7.exe
Size

547KB
MD5

91fa6215582b42f5cca599ba02bb737e
SHA1

77ea850c55d4d6dc51e1e25235a27d5f90d733e6
SHA256

7203a338d66ac5456e265ed210c09b7c28ec6bd50d46d48c8d38fe14846f834f
SHA512

e3e9bce29241fac8e9920acc39b4aec8b1dc70b1b954d634ee4776dc336c31657591a1d8bc735d5a827622ec3020172c0c54327ad150ba89baf85a5b9b656738

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

C2

http://lodddd01.info/

http://lodddd02.info/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\UBlockPlugin\\plugin.exe\""	plugin.exe

Buer Loader 10 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/files/0x0009000000012307-55.dat	buer
behavioral1/files/0x0009000000012307-56.dat	buer
behavioral1/files/0x0009000000012307-64.dat	buer
behavioral1/files/0x0009000000012307-63.dat	buer
behavioral1/files/0x0009000000012307-62.dat	buer
behavioral1/files/0x0009000000012307-61.dat	buer
behavioral1/files/0x0009000000012307-60.dat	buer
behavioral1/files/0x0009000000012307-59.dat	buer
behavioral1/files/0x0009000000012307-58.dat	buer
behavioral1/files/0x0009000000012307-66.dat	buer

Executes dropped EXE 1 IoCs

pid	Process
876	plugin.exe

Deletes itself 1 IoCs

pid	Process
876	plugin.exe

Loads dropped DLL 8 IoCs

pid	Process
1108	7.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	876	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe
1628	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1628	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 876	1108	7.exe	27
PID 1108 wrote to memory of 876	1108	7.exe	27
PID 1108 wrote to memory of 876	1108	7.exe	27
PID 1108 wrote to memory of 876	1108	7.exe	27
PID 876 wrote to memory of 1660	876	plugin.exe	28
PID 876 wrote to memory of 1660	876	plugin.exe	28
PID 876 wrote to memory of 1660	876	plugin.exe	28
PID 876 wrote to memory of 1660	876	plugin.exe	28
PID 876 wrote to memory of 1628	876	plugin.exe	29
PID 876 wrote to memory of 1628	876	plugin.exe	29
PID 876 wrote to memory of 1628	876	plugin.exe	29
PID 876 wrote to memory of 1628	876	plugin.exe	29

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108
- C:\ProgramData\UBlockPlugin\plugin.exe
  C:\ProgramData\UBlockPlugin\plugin.exe "C:\Users\Admin\AppData\Local\Temp\7.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\UBlockPlugin\plugin.exe
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 172
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-54-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/1628-67-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing