Analysis

  • max time kernel
    181s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-06-2022 22:39

General

  • Target

    5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3.exe

  • Size

    232KB

  • MD5

    f267d07c82912e0222666aa2cdc4cbee

  • SHA1

    630f7d9cbbb0af1a0d90502bc4be4dbc32b458de

  • SHA256

    5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3

  • SHA512

    1ccfb880532191238f8a1da2448b83ba7128868431b65909bbc7ebfc29a87ab6bc1060ac56b736d769edb8d703b655f9d5fb13fd18bbc1257dfaba0a8d8bdc42

Score
10/10

Malware Config

Extracted

Family

buer

C2

http://45.12.32.252:8080/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Buer Loader 4 IoCs

    Detects Buer loader in memory or disk.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3.exe
    "C:\Users\Admin\AppData\Local\Temp\5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe
      C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe "C:\Users\Admin\AppData\Local\Temp\5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3.exe" ensgJJ
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4984
      • C:\Windows\SysWOW64\secinit.exe
        C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe
        3⤵
          PID:548
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 272
            4⤵
            • Program crash
            PID:3148
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 280
            4⤵
            • Program crash
            PID:920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 436
        2⤵
        • Program crash
        PID:4388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4092 -ip 4092
      1⤵
        PID:4352
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 548 -ip 548
        1⤵
          PID:3120
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 548 -ip 548
          1⤵
            PID:4168

          Network

            No results found
          • 209.197.3.8:80
            322 B
            7
          • 209.197.3.8:80
            322 B
            7
          • 209.197.3.8:80
            322 B
            7
          • 45.12.32.252:8080
            manager.exe
            260 B
            5
          • 45.12.32.252:8080
            manager.exe
            260 B
            5
          • 45.12.32.252:8080
            manager.exe
            260 B
            5
          • 45.12.32.252:8080
            manager.exe
            260 B
            5
          • 45.12.32.252:8080
            manager.exe
            260 B
            5
          • 45.12.32.252:8080
            manager.exe
            260 B
            5
          No results found

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe

            Filesize

            232KB

            MD5

            f267d07c82912e0222666aa2cdc4cbee

            SHA1

            630f7d9cbbb0af1a0d90502bc4be4dbc32b458de

            SHA256

            5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3

            SHA512

            1ccfb880532191238f8a1da2448b83ba7128868431b65909bbc7ebfc29a87ab6bc1060ac56b736d769edb8d703b655f9d5fb13fd18bbc1257dfaba0a8d8bdc42

          • C:\Users\Admin\AppData\Roaming\ActiveX\manager.exe

            Filesize

            232KB

            MD5

            f267d07c82912e0222666aa2cdc4cbee

            SHA1

            630f7d9cbbb0af1a0d90502bc4be4dbc32b458de

            SHA256

            5c7f5813142029aa1a1326ebef5b7664ab93e0c6bb40cbb40bf9146556a783f3

            SHA512

            1ccfb880532191238f8a1da2448b83ba7128868431b65909bbc7ebfc29a87ab6bc1060ac56b736d769edb8d703b655f9d5fb13fd18bbc1257dfaba0a8d8bdc42

          • memory/548-142-0x0000000000A00000-0x0000000003B8E000-memory.dmp

            Filesize

            49.6MB

          • memory/4092-141-0x0000000040000000-0x000000004318E000-memory.dmp

            Filesize

            49.6MB

          • memory/4092-131-0x0000000000594000-0x000000000059B000-memory.dmp

            Filesize

            28KB

          • memory/4092-132-0x0000000002130000-0x0000000002139000-memory.dmp

            Filesize

            36KB

          • memory/4092-130-0x0000000000594000-0x000000000059B000-memory.dmp

            Filesize

            28KB

          • memory/4092-136-0x0000000040000000-0x000000004318E000-memory.dmp

            Filesize

            49.6MB

          • memory/4984-140-0x0000000040000000-0x000000004318E000-memory.dmp

            Filesize

            49.6MB

          • memory/4984-139-0x0000000000575000-0x000000000057C000-memory.dmp

            Filesize

            28KB

          • memory/4984-137-0x0000000000575000-0x000000000057C000-memory.dmp

            Filesize

            28KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.