Extracted

• • Target

    ken.exe

  • Size

    228KB

  • MD5

    14e0e1a26f0e29171486cb2feb89fc3e

  • SHA1

    cb3f2b4e3f5060088c6158f4b6c5b6d627f68a20

  • SHA256

    c69a9adf7333a5098d91be899802e6f0e77de4d1be8d11363dccd0fc830311c5

  • SHA512

    12ea8bb6bdcc809a2ba46a33cb69e4535af3a5ba9750179cf1a8f050ae1e3f0ea544000d504a2318c8d22e297eaa466f7977c593f3d00ec2c24276e66abd8430

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2