Extracted

• • Target

    ReviewDocument.exe

  • Size

    178KB

  • MD5

    9bd3bbc082d0b3446fd456d750a8bbbe

  • SHA1

    d50d739d91ff82ad31a6227ba734b6658f1a577a

  • SHA256

    63913936a820bf5e79bccb7ac74b80f78fae9aec0f2dbfa097f057227a2e4aa2

  • SHA512

    c0ba3a8a7a305dfc2539ef0ead8e418795532eb39a70571296e06d5b27c2cdd9425165dd88afbb90511c2bb68be5bd587c5233743a395d0b3dfe76d90a42bb7b

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2