General

  • Target

    dw.pm.exe

  • Size

    82KB

  • Sample

    210201-rrle2q2rc2

  • MD5

    49392cc9138f2d685737955950fd8d69

  • SHA1

    8b418f639b4bc71ab224972537278f2d23676df8

  • SHA256

    4f7ccbc55dda5ed45be0fc7dc48b18719556ac9018d5aa4eb9f9ff0470eaca95

  • SHA512

    a75a58cda433f1baeeede01418661fc57512ba52dba585e2cf576294d7be4e39e9fc6af588cd5a3f855665abd038ca4d711567c22bbb1505752421d6357ff123

Score
10/10

Malware Config

Extracted

Family

buer

C2

webgraitupeople.com

Targets

    • Target

      dw.pm.exe

    • Size

      82KB

    • MD5

      49392cc9138f2d685737955950fd8d69

    • SHA1

      8b418f639b4bc71ab224972537278f2d23676df8

    • SHA256

      4f7ccbc55dda5ed45be0fc7dc48b18719556ac9018d5aa4eb9f9ff0470eaca95

    • SHA512

      a75a58cda433f1baeeede01418661fc57512ba52dba585e2cf576294d7be4e39e9fc6af588cd5a3f855665abd038ca4d711567c22bbb1505752421d6357ff123

    Score
    10/10
    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks