Analysis

  • max time kernel
    136s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-08-2023 07:25

General

  • Target

    ReviewPrint.exe

  • Size

    330KB

  • MD5

    5be0349cfd478100b67fa4a867cfc516

  • SHA1

    ad95587989a7bdeb80380a9e8b179f7e11db53a8

  • SHA256

    4332bb07339c3096997fbb89b695afeb3b1e21632c8ecb4e144ec883d61ab066

  • SHA512

    4a942340eaa75f5a98caf8073c2acc1c8c9310113d4d9e5b76cd4d91d87baa913c250caab657bc374f20233fc79d75dc6e29c74b4e301634934593dc86eb8534

  • SSDEEP

    1536:OphmidUnwrFnOATLZ+ZlDD44444444444444444444444444444444444444444t:sJUGpU1T83KvqAwsiYQmwf

Score
10/10

Malware Config

Extracted

Family

buer

C2

https://161.35.192.121/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Buer Loader 4 IoCs

    Detects Buer loader in memory or disk.

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ReviewPrint.exe
    "C:\Users\Admin\AppData\Local\Temp\ReviewPrint.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\ProgramData\f4a9f0553dd72a03a938\gennt.exe
      C:\ProgramData\f4a9f0553dd72a03a938\gennt.exe "C:\Users\Admin\AppData\Local\Temp\ReviewPrint.exe" ensgJJ
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\f4a9f0553dd72a03a938}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\f4a9f0553dd72a03a938\gennt.exe

    Filesize

    330KB

    MD5

    5be0349cfd478100b67fa4a867cfc516

    SHA1

    ad95587989a7bdeb80380a9e8b179f7e11db53a8

    SHA256

    4332bb07339c3096997fbb89b695afeb3b1e21632c8ecb4e144ec883d61ab066

    SHA512

    4a942340eaa75f5a98caf8073c2acc1c8c9310113d4d9e5b76cd4d91d87baa913c250caab657bc374f20233fc79d75dc6e29c74b4e301634934593dc86eb8534

  • C:\ProgramData\f4a9f0553dd72a03a938\gennt.exe

    Filesize

    330KB

    MD5

    5be0349cfd478100b67fa4a867cfc516

    SHA1

    ad95587989a7bdeb80380a9e8b179f7e11db53a8

    SHA256

    4332bb07339c3096997fbb89b695afeb3b1e21632c8ecb4e144ec883d61ab066

    SHA512

    4a942340eaa75f5a98caf8073c2acc1c8c9310113d4d9e5b76cd4d91d87baa913c250caab657bc374f20233fc79d75dc6e29c74b4e301634934593dc86eb8534

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_irluafe0.1yl.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2760-59-0x0000000007970000-0x0000000007FEA000-memory.dmp

    Filesize

    6.5MB

  • memory/2760-60-0x0000000007330000-0x000000000734A000-memory.dmp

    Filesize

    104KB

  • memory/2760-43-0x0000000006030000-0x000000000604E000-memory.dmp

    Filesize

    120KB

  • memory/2760-69-0x0000000074A30000-0x00000000751E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2760-66-0x00000000075B0000-0x00000000075B8000-memory.dmp

    Filesize

    32KB

  • memory/2760-65-0x0000000007680000-0x000000000769A000-memory.dmp

    Filesize

    104KB

  • memory/2760-64-0x0000000007560000-0x000000000756E000-memory.dmp

    Filesize

    56KB

  • memory/2760-27-0x00000000026D0000-0x0000000002706000-memory.dmp

    Filesize

    216KB

  • memory/2760-28-0x0000000074A30000-0x00000000751E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2760-29-0x0000000002BF0000-0x0000000002C00000-memory.dmp

    Filesize

    64KB

  • memory/2760-30-0x00000000052A0000-0x00000000058C8000-memory.dmp

    Filesize

    6.2MB

  • memory/2760-31-0x0000000005020000-0x0000000005042000-memory.dmp

    Filesize

    136KB

  • memory/2760-32-0x00000000051C0000-0x0000000005226000-memory.dmp

    Filesize

    408KB

  • memory/2760-35-0x00000000059C0000-0x0000000005A26000-memory.dmp

    Filesize

    408KB

  • memory/2760-63-0x0000000074A30000-0x00000000751E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2760-62-0x00000000075C0000-0x0000000007656000-memory.dmp

    Filesize

    600KB

  • memory/2760-61-0x0000000007390000-0x000000000739A000-memory.dmp

    Filesize

    40KB

  • memory/2760-46-0x000000007F830000-0x000000007F840000-memory.dmp

    Filesize

    64KB

  • memory/2760-47-0x0000000006600000-0x0000000006632000-memory.dmp

    Filesize

    200KB

  • memory/2760-48-0x0000000070850000-0x000000007089C000-memory.dmp

    Filesize

    304KB

  • memory/2760-58-0x00000000065E0000-0x00000000065FE000-memory.dmp

    Filesize

    120KB

  • memory/2760-45-0x0000000002BF0000-0x0000000002C00000-memory.dmp

    Filesize

    64KB

  • memory/2840-75-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2840-26-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2840-19-0x00000000001B0000-0x00000000001BF000-memory.dmp

    Filesize

    60KB

  • memory/5048-0-0x0000000000660000-0x000000000066F000-memory.dmp

    Filesize

    60KB

  • memory/5048-9-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/5048-3-0x00000000001F0000-0x00000000001FD000-memory.dmp

    Filesize

    52KB

  • memory/5048-18-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/5048-6-0x0000000040000000-0x000000004000C000-memory.dmp

    Filesize

    48KB

  • memory/5048-1-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB