buer | 69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a

General

Target

b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe
Size

300KB
MD5

b84cb1bf75e472973bed157bab410f04
SHA1

fe4d97e9fd68677ae1e1b459885b3979eabba445
SHA256

69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a
SHA512

266128f62ef53d596196bed76ef94c9aef135f248a2c0a9b44a909bdff4613a048875d9a8debf7082e50eea29acb32891fd7edc535d085558a9250a5f402c9a8
SSDEEP

6144:IXTq8tcMqCZuCkGZGXOGrmtiwJpIS3tJ0dNaVcW+VoImI8EDQGXI/:38cMq8uepPrSNamDT98EdI

Score

10^/10

buer loader persistence

Malware Config

Extracted

Family

buer

C2

https://officewestunionbank.com/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

AutoReg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\656f82acb09c236f5a68\\AutoReg.exe\""	AutoReg.exe

Buer Loader 9 IoCs

Detects Buer loader in memory or disk.

loader

Processes:

resource	yara_rule
behavioral1/memory/1652-2-0x0000000000220000-0x000000000027C000-memory.dmp	buer
behavioral1/memory/1652-4-0x0000000040000000-0x000000004005D000-memory.dmp	buer
behavioral1/memory/1652-13-0x0000000000220000-0x000000000027C000-memory.dmp	buer
behavioral1/memory/1652-12-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral1/memory/1988-15-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral1/memory/1988-16-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral1/memory/1988-18-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral1/memory/1988-19-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer
behavioral1/memory/1988-32-0x0000000040000000-0x0000000040BA8000-memory.dmp	buer

Deletes itself 1 IoCs

Processes:

AutoReg.exe

pid process

1988 AutoReg.exe
Executes dropped EXE 1 IoCs

Processes:

AutoReg.exe

pid process

1988 AutoReg.exe
Loads dropped DLL 2 IoCs

Processes:

b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

pid process

1652 b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe
1652 b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

pid	process
1988	AutoReg.exe

pid	process
1988	AutoReg.exe

pid	process
1652	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe
1652	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AutoReg.exe

description	ioc	process
File opened (read-only)	\??\N:	AutoReg.exe
File opened (read-only)	\??\P:	AutoReg.exe
File opened (read-only)	\??\Q:	AutoReg.exe
File opened (read-only)	\??\T:	AutoReg.exe
File opened (read-only)	\??\V:	AutoReg.exe
File opened (read-only)	\??\S:	AutoReg.exe
File opened (read-only)	\??\X:	AutoReg.exe
File opened (read-only)	\??\E:	AutoReg.exe
File opened (read-only)	\??\G:	AutoReg.exe
File opened (read-only)	\??\K:	AutoReg.exe
File opened (read-only)	\??\L:	AutoReg.exe
File opened (read-only)	\??\O:	AutoReg.exe
File opened (read-only)	\??\W:	AutoReg.exe
File opened (read-only)	\??\Y:	AutoReg.exe
File opened (read-only)	\??\Z:	AutoReg.exe
File opened (read-only)	\??\B:	AutoReg.exe
File opened (read-only)	\??\I:	AutoReg.exe
File opened (read-only)	\??\J:	AutoReg.exe
File opened (read-only)	\??\M:	AutoReg.exe
File opened (read-only)	\??\R:	AutoReg.exe
File opened (read-only)	\??\A:	AutoReg.exe
File opened (read-only)	\??\H:	AutoReg.exe
File opened (read-only)	\??\U:	AutoReg.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe

description	pid	process	target process
PID 1652 wrote to memory of 1988	1652	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe
PID 1652 wrote to memory of 1988	1652	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe
PID 1652 wrote to memory of 1988	1652	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe
PID 1652 wrote to memory of 1988	1652	b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe	AutoReg.exe

C:\Users\Admin\AppData\Local\Temp\b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652

C:\ProgramData\656f82acb09c236f5a68\AutoReg.exe
C:\ProgramData\656f82acb09c236f5a68\AutoReg.exe "C:\Users\Admin\AppData\Local\Temp\b84cb1bf75e472973bed157bab410f04_JaffaCakes118.exe" ensgJJ
2⤵
- Modifies WinLogon for persistence
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\656f82acb09c236f5a68\AutoReg.exe
Filesize
300KB

MD5
b84cb1bf75e472973bed157bab410f04

SHA1
fe4d97e9fd68677ae1e1b459885b3979eabba445

SHA256
69377f70dc61fe37d51443a5ce8a312aa7b682c61574b8ff02fef4e9d798133a

SHA512
266128f62ef53d596196bed76ef94c9aef135f248a2c0a9b44a909bdff4613a048875d9a8debf7082e50eea29acb32891fd7edc535d085558a9250a5f402c9a8

Download Submit
memory/1652-1-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1652-2-0x0000000000220000-0x000000000027C000-memory.dmp

Filesize
368KB

Download
memory/1652-4-0x0000000040000000-0x000000004005D000-memory.dmp

Filesize
372KB

Download
memory/1652-13-0x0000000000220000-0x000000000027C000-memory.dmp

Filesize
368KB

Download
memory/1652-12-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/1988-15-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/1988-16-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/1988-18-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/1988-19-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download
memory/1988-32-0x0000000040000000-0x0000000040BA8000-memory.dmp

Filesize
11.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads