Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-05-2021 09:54
General
-
Target
Electronic_Tracking_INV_#9836582365728523752.exe
-
Size
245KB
-
MD5
64f86981c7450dfd2c3915f213fc6720
-
SHA1
5410d0e8569f0936b32de3199e8a187d6227fc1f
-
SHA256
a1bdc2ca2e359ac7d5c26afb3cd89bb39285b8a8acc5876e691ceb4ba807b704
-
SHA512
02e9e2e41a96a4e0279de44c5cdd7c18a4d08966e0e2ba9979d929f0fa5a902db1ceb3f2eb8a73d97725eed917f9e57d11999a0218f3f286908bf7e731931b22
Score
10/10
Malware Config
Extracted
Family
buer
C2
https://specialhosting.ga/
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Electronic_Tracking_INV_#9836582365728523752.exe"C:\Users\Admin\AppData\Local\Temp\Electronic_Tracking_INV_#9836582365728523752.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\electronic_tracking_inv_#9836582365728523752.exe"C:\Users\Admin\AppData\Local\Temp\Electronic_Tracking_INV_#9836582365728523752.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
52KB
-
Filesize
8KB
-
Filesize
48KB