buer | 6eb872c05e3839b491fc9515065fcb0eeb209b3981a1ee3e3140495f907db37c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
15-12-2020 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe
Size

90KB
MD5

3a94c5b0350d50bf1485156e75a82ded
SHA1

782da73b0165597dace21d0fcf3bd5cf54716d2e
SHA256

6eb872c05e3839b491fc9515065fcb0eeb209b3981a1ee3e3140495f907db37c
SHA512

4944810f8bbfdbeda95cbede4389ebcf020dd2030aaf0bbfe4e393d9cc52511077fa00963039104b60c52ac3f1027a3e20a4b80dd44e6cbe13bc4e1028fad7fa

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

ujinkesbank.com

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/1288-3-0x0000000040000000-0x0000000040009000-memory.dmp	buer
behavioral1/memory/1288-4-0x0000000040005DA8-mapping.dmp	buer
behavioral1/memory/1288-5-0x0000000040000000-0x0000000040009000-memory.dmp	buer

Loads dropped DLL 1 IoCs

pid	Process
1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1288	1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1288	1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe	29
PID 1728 wrote to memory of 1288	1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe	29
PID 1728 wrote to memory of 1288	1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe	29
PID 1728 wrote to memory of 1288	1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe	29
PID 1728 wrote to memory of 1288	1728	SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop15.61988.6090.30519.exe"
  2⤵
  PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-3-0x0000000040000000-0x0000000040009000-memory.dmp

Filesize
36KB

Download
memory/1288-5-0x0000000040000000-0x0000000040009000-memory.dmp

Filesize
36KB

Download