buer | 6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

General

Target

01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
Size

3.9MB
MD5

01644c1081aaa09a39deb82c7bcc48a7
SHA1

0522a3fed1b3d73029e6494e4e3b1019ee40a48d
SHA256

6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c
SHA512

b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0
SSDEEP

98304:iq2jZUD9cGCMIcGDJxgQgEZjAgDZIuIsYOY1sFiAJ8:i5jZUDxIXuJEpNlIuZY1giT

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

C2

http://burload01.top/

http://burload02.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\errorResponder.exe\""	errorResponder.exe

Buer Loader 9 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral1/memory/2028-3-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-4-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-5-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-7-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-8-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-9-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-17-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2028-28-0x000000003F3E0000-0x000000004054F000-memory.dmp	buer
behavioral1/memory/2576-35-0x000000003F7B0000-0x000000004091F000-memory.dmp	buer

Deletes itself 1 IoCs

pid	Process
2576	errorResponder.exe

Executes dropped EXE 1 IoCs

pid	Process
2576	errorResponder.exe

Loads dropped DLL 1 IoCs

pid	Process
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2576	errorResponder.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1136	2576	WerFault.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
2576	errorResponder.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2576	2028	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\ProgramData\ErrorResponder\errorResponder.exe
  C:\ProgramData\ErrorResponder\errorResponder.exe "C:\Users\Admin\AppData\Local\Temp\01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:2576
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\ErrorResponder\errorResponder.exe
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 420
    3⤵
    - Program crash
    PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\ErrorResponder\errorResponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
memory/2028-5-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-2-0x0000000077500000-0x0000000077501000-memory.dmp

Filesize
4KB

Download
memory/2028-3-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-4-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-6-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2028-17-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-7-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-8-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-9-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-28-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2028-0-0x000000003F3E0000-0x000000004054F000-memory.dmp

Filesize
17.4MB

Download
memory/2028-29-0x0000000004250000-0x00000000053BF000-memory.dmp

Filesize
17.4MB

Download
memory/2576-11-0x0000000000090000-0x000000000011E000-memory.dmp

Filesize
568KB

Download
memory/2576-30-0x0000000077500000-0x0000000077501000-memory.dmp

Filesize
4KB

Download
memory/2576-20-0x0000000000090000-0x000000000011E000-memory.dmp

Filesize
568KB

Download
memory/2576-13-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2576-26-0x0000000000090000-0x000000000011E000-memory.dmp

Filesize
568KB

Download
memory/2576-25-0x0000000000090000-0x000000000011E000-memory.dmp

Filesize
568KB

Download
memory/2576-24-0x0000000000090000-0x000000000011E000-memory.dmp

Filesize
568KB

Download
memory/2576-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-32-0x000000003F7B0000-0x000000004091F000-memory.dmp

Filesize
17.4MB

Download
memory/2576-33-0x0000000000090000-0x000000000011E000-memory.dmp

Filesize
568KB

Download
memory/2576-35-0x000000003F7B0000-0x000000004091F000-memory.dmp

Filesize
17.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads