Analysis

  • max time kernel
    158s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 04:01

General

  • Target

    a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61.exe

  • Size

    1.5MB

  • MD5

    630ab459be2675ab53b9a3e4eeba9110

  • SHA1

    77f8b36c24cd0de2dcfe86b96e403bfad9d91112

  • SHA256

    a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61

  • SHA512

    33dce0472a05889df913693b80d4002a7dfab036f0201fa38d011cb7d9406146d6f34525023ed24131efa2ad754fad8715eec6359fe47350d1ffb45ca03525ff

Malware Config

Extracted

Family

buer

C2

http://loaadik01.pro/

http://loaadik02.pro/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Buer Loader 7 IoCs

    Detects Buer loader in memory or disk.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61.exe
    "C:\Users\Admin\AppData\Local\Temp\a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Roaming\UBlockPlugin\plugin.exe
      C:\Users\Admin\AppData\Roaming\UBlockPlugin\plugin.exe "C:\Users\Admin\AppData\Local\Temp\a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61.exe" ensgJJ
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\UBlockPlugin\plugin.exe

    Filesize

    1.5MB

    MD5

    630ab459be2675ab53b9a3e4eeba9110

    SHA1

    77f8b36c24cd0de2dcfe86b96e403bfad9d91112

    SHA256

    a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61

    SHA512

    33dce0472a05889df913693b80d4002a7dfab036f0201fa38d011cb7d9406146d6f34525023ed24131efa2ad754fad8715eec6359fe47350d1ffb45ca03525ff

  • C:\Users\Admin\AppData\Roaming\UBlockPlugin\plugin.exe

    Filesize

    1.5MB

    MD5

    630ab459be2675ab53b9a3e4eeba9110

    SHA1

    77f8b36c24cd0de2dcfe86b96e403bfad9d91112

    SHA256

    a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61

    SHA512

    33dce0472a05889df913693b80d4002a7dfab036f0201fa38d011cb7d9406146d6f34525023ed24131efa2ad754fad8715eec6359fe47350d1ffb45ca03525ff

  • memory/228-139-0x0000000077960000-0x0000000077B03000-memory.dmp

    Filesize

    1.6MB

  • memory/228-138-0x000000003FE40000-0x0000000040221000-memory.dmp

    Filesize

    3.9MB

  • memory/228-140-0x000000003FE40000-0x0000000040221000-memory.dmp

    Filesize

    3.9MB

  • memory/228-143-0x000000003FE40000-0x0000000040221000-memory.dmp

    Filesize

    3.9MB

  • memory/228-144-0x000000003FE40000-0x0000000040221000-memory.dmp

    Filesize

    3.9MB

  • memory/1760-133-0x000000003F2B0000-0x000000003F691000-memory.dmp

    Filesize

    3.9MB

  • memory/1760-134-0x000000003F2B0000-0x000000003F691000-memory.dmp

    Filesize

    3.9MB

  • memory/1760-132-0x000000003F2B0000-0x000000003F691000-memory.dmp

    Filesize

    3.9MB

  • memory/1760-131-0x0000000077960000-0x0000000077B03000-memory.dmp

    Filesize

    1.6MB

  • memory/1760-130-0x000000003F2B0000-0x000000003F691000-memory.dmp

    Filesize

    3.9MB

  • memory/1760-141-0x000000003F2B0000-0x000000003F691000-memory.dmp

    Filesize

    3.9MB

  • memory/1760-142-0x0000000077960000-0x0000000077B03000-memory.dmp

    Filesize

    1.6MB