buer | d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1 | Triage

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-04-2022 14:39

Sharing

Report Analysis Logs

General

Target

d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1.exe
Size

6.6MB
MD5

c6d242d56b18c6a490f9f95f0fc8b9ac
SHA1

34f33ab16581bac622962829e2b8cd491d8d107d
SHA256

d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1
SHA512

29c4ae0e8b181f3572ea72e793a1832f6a0335f9032e03100476f257bdd7da43d56fbf7a1548a4484eec0c310742442f9cd285c65ada0a7f3b8fd8a040fa1326

Score

10^/10

buer loader

Malware Config

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/memory/996-130-0x0000000002A10000-0x0000000002A1C000-memory.dmp	buer
behavioral2/memory/996-134-0x0000000040000000-0x0000000040009000-memory.dmp	buer
behavioral2/memory/996-137-0x0000000002A00000-0x0000000002A09000-memory.dmp	buer

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
996	d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1.exe
996	d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1.exe

C:\Users\Admin\AppData\Local\Temp\d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1.exe
"C:\Users\Admin\AppData\Local\Temp\d971a1036ec99bb5d51fb6ae6556f8e4b606932ba79e47e69e6696e48116d6b1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-130-0x0000000002A10000-0x0000000002A1C000-memory.dmp

Filesize
48KB

Download
memory/996-134-0x0000000040000000-0x0000000040009000-memory.dmp

Filesize
36KB

Download
memory/996-137-0x0000000002A00000-0x0000000002A09000-memory.dmp

Filesize
36KB

Download