Overview

overview

10

Static

static

1

ServApi.exe

windows7_x64

10

ServApi.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ServApi.exe

  • Size

    281KB

  • Sample

    210302-mgpzzr767e

  • MD5

    19ca9bf5eebc9e2f0bd3230f262348fd

  • SHA1

    e8157d7e277ccf04de3476c1845cd597c112786e

  • SHA256

    f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283

  • SHA512

    636859bd44528e75e5c6c25ad4fce12e0482fdd0de3798c863efbf4326e77db184b1354fc5433672239dee4350a0fc12427acc9a4bedfd17487e96ee5e397d72

Score
10/10
buerloader

Malware Config

Extracted

Family

buer

C2

verstudiosan.com

Targets

    • Target

      ServApi.exe

    • Size

      281KB

    • MD5

      19ca9bf5eebc9e2f0bd3230f262348fd

    • SHA1

      e8157d7e277ccf04de3476c1845cd597c112786e

    • SHA256

      f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283

    • SHA512

      636859bd44528e75e5c6c25ad4fce12e0482fdd0de3798c863efbf4326e77db184b1354fc5433672239dee4350a0fc12427acc9a4bedfd17487e96ee5e397d72

    Score
    10/10
    buerloader

    • Buer

      Buer is a new modular loader first seen in August 2019.

      loaderbuer

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks