buer | 14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8

Analysis

max time kernel
113s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09/03/2022, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8.dll
Size 1.9MB
Sample220309-c8mz5scfa5
SHA256 14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8
MD5 c5cc5ae8f7a33279195ff44c3f8ddcce
SHA1 b308572cfbb7e70fa4cbca64676974b448641436
SHA512 ac4ec63dae4985f19f1ffe642c9436d8abab0d5248a44e6fe372aad242dea3922eea06a051a141fb63bf8edfe00c2ffc7759971e4782ce2a0c48f963f751c54e
MD5 SHA1 SHA512

Score

10^/10

buer evasion loader

Malware Config

Extracted

Family

buer

frrn8--ddjm_b./,rmn-
frrn8--ddjm_b.0,rmn-

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 1 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral2/memory/3352-134-0x00000000745D0000-0x0000000074A5F000-memory.dmp	buer

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Wine	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3352	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3408	3352	WerFault.exe	55

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	rundll32.exe
3352	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3352	1564	rundll32.exe	55
PID 1564 wrote to memory of 3352	1564	rundll32.exe	55
PID 1564 wrote to memory of 3352	1564	rundll32.exe	55

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14dd52af1b4ce65abf73c7b479f4af42102b3891494186118112406a1e0d5bf8.dll,#1
  2⤵
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 760
    3⤵
    - Program crash
    PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3352 -ip 3352
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3352 -ip 3352
1⤵
PID:2644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3352-133-0x0000000076F80000-0x0000000077123000-memory.dmp

Download

memory/3352-134-0x00000000745D0000-0x0000000074A5F000-memory.dmp

Download