Overview

overview

10

Static

static

3

b84cb1bf75...18.exe

windows7-x64

10

b84cb1bf75...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b84cb1bf75e472973bed157bab410f04_JaffaCakes118

  • Size

    300KB

  • Sample

    240617-naefwsyakf

  • MD5

    b84cb1bf75e472973bed157bab410f04

  • SHA1

    fe4d97e9fd68677ae1e1b459885b3979eabba445

  • SHA256

    69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a

  • SHA512

    266128f62ef53d596196bed76ef94c9aef135f248a2c0a9b44a909bdff4613a048875d9a8debf7082e50eea29acb32891fd7edc535d085558a9250a5f402c9a8

  • SSDEEP

    6144:IXTq8tcMqCZuCkGZGXOGrmtiwJpIS3tJ0dNaVcW+VoImI8EDQGXI/:38cMq8uepPrSNamDT98EdI

Score
10/10
buerloaderpersistence

Malware Config

Extracted

Family

buer

C2

https://officewestunionbank.com/

Targets

    • Target

      b84cb1bf75e472973bed157bab410f04_JaffaCakes118

    • Size

      300KB

    • MD5

      b84cb1bf75e472973bed157bab410f04

    • SHA1

      fe4d97e9fd68677ae1e1b459885b3979eabba445

    • SHA256

      69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a

    • SHA512

      266128f62ef53d596196bed76ef94c9aef135f248a2c0a9b44a909bdff4613a048875d9a8debf7082e50eea29acb32891fd7edc535d085558a9250a5f402c9a8

    • SSDEEP

      6144:IXTq8tcMqCZuCkGZGXOGrmtiwJpIS3tJ0dNaVcW+VoImI8EDQGXI/:38cMq8uepPrSNamDT98EdI

    Score
    10/10
    buerloaderpersistence

    • Buer

      Buer is a new modular loader first seen in August 2019.

      loaderbuer

    • Modifies WinLogon for persistence

      persistence

    • Buer Loader

      Detects Buer loader in memory or disk.

      loader

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks