Overview

overview

10

Static

static

14dd52af1b...f8.dll

windows7_x64

9

14dd52af1b...f8.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8
  • Size 1.9MB
  • Sample220309-c8mz5scfa5
  • SHA256 14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8
  • MD5 SHA1 SHA512
Score
10/10
buerevasionloader

Malware Config

Extracted

Family

  • buer

C2

  • frrn8--ddjm_b./,rmn-

  • frrn8--ddjm_b.0,rmn-

Targets

    • Target
      14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8
    • Size 1.9MB
    • SHA256 14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8
    • MD5 SHA1 SHA512
    Score
    10/10
    evasionbuerloader

    • Buer

      Buer is a new modular loader first seen in August 2019.

      loaderbuer

    • Buer Loader

      Detects Buer loader in memory or disk.

      loader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks