Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    29/05/2022, 16:06

General

  • Target

    0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe

  • Size

    1.9MB

  • MD5

    73461127ecd53340878c5c8dd558cacb

  • SHA1

    4efb8f4f888fed27a1866118739fb4b3e7dcbd0e

  • SHA256

    0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f

  • SHA512

    2a7eb7a92bda07637631356faf6d9357cf3393c119cf663f3c9d31ec8c64c53e67801bd0c26004a973346e98a47a4f75e711899cf1c1b142a50df00306b9d390

Malware Config

Extracted

Family

buer

C2

http://loood1.top/

http://loood2.top/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Buer Loader 4 IoCs

    Detects Buer loader in memory or disk.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe
    "C:\Users\Admin\AppData\Local\Temp\0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe
      C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe "C:\Users\Admin\AppData\Local\Temp\0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f.exe" ensgJJ
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Deletes itself
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Windows\SysWOW64\secinit.exe
        C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe
        3⤵
          PID:1116

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1116-78-0x0000000000080000-0x0000000000081000-memory.dmp

      Filesize

      4KB

    • memory/1116-81-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1116-75-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1116-77-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1116-74-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1116-73-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1116-70-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1116-68-0x00000000001C0000-0x000000000067B000-memory.dmp

      Filesize

      4.7MB

    • memory/1256-55-0x000000003F050000-0x000000003F50B000-memory.dmp

      Filesize

      4.7MB

    • memory/1256-64-0x0000000077A20000-0x0000000077BA0000-memory.dmp

      Filesize

      1.5MB

    • memory/1256-61-0x000000003FB90000-0x000000004004B000-memory.dmp

      Filesize

      4.7MB

    • memory/1256-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

      Filesize

      8KB

    • memory/1256-62-0x000000003F050000-0x000000003F50B000-memory.dmp

      Filesize

      4.7MB

    • memory/1256-59-0x0000000077A20000-0x0000000077BA0000-memory.dmp

      Filesize

      1.5MB

    • memory/1280-72-0x000000003FB90000-0x000000004004B000-memory.dmp

      Filesize

      4.7MB

    • memory/1280-63-0x000000003FB90000-0x000000004004B000-memory.dmp

      Filesize

      4.7MB

    • memory/1280-82-0x000000003FB90000-0x000000004004B000-memory.dmp

      Filesize

      4.7MB

    • memory/1280-83-0x000000003FB90000-0x000000004004B000-memory.dmp

      Filesize

      4.7MB