Extracted

• • Target

    7.exe

  • Size

    547KB

  • MD5

    91fa6215582b42f5cca599ba02bb737e

  • SHA1

    77ea850c55d4d6dc51e1e25235a27d5f90d733e6

  • SHA256

    7203a338d66ac5456e265ed210c09b7c28ec6bd50d46d48c8d38fe14846f834f

  • SHA512

    e3e9bce29241fac8e9920acc39b4aec8b1dc70b1b954d634ee4776dc336c31657591a1d8bc735d5a827622ec3020172c0c54327ad150ba89baf85a5b9b656738

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Buer Loader

    Detects Buer loader in memory or disk.

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2