buer | 19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b

General

Target

19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
Size

6.6MB
MD5

037d4104c1e24c0bb8372981fa8db345
SHA1

71ade2a6e235d97283961cec0902a5c2836b2a22
SHA256

19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b
SHA512

64382367232993f9f221ae91b18722c6a4aeae7720cc9e07e3d76be001b3222c7e57b6153e27bcbf3ae8b63e00367844f10805fc999e734bb0ee0caa94679a7a

Score

10^/10

buer loader

Malware Config

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral2/memory/4644-130-0x00000000029C0000-0x00000000029CC000-memory.dmp	buer
behavioral2/memory/4644-134-0x0000000040000000-0x0000000040009000-memory.dmp	buer
behavioral2/memory/4644-137-0x00000000030E0000-0x00000000030E9000-memory.dmp	buer

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\G:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\L:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\N:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\Q:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\R:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\S:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\U:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\W:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\A:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\J:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\T:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\Y:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\I:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\M:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\F:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\H:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\K:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\O:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\P:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\V:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\B:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\E:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
File opened (read-only)	\??\X:	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4644	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
4644	19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe

C:\Users\Admin\AppData\Local\Temp\19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe
"C:\Users\Admin\AppData\Local\Temp\19f68a2c0567aa9d47fc9ca69fc0a2192413f38142b61911a8999ce6c4c16e5b.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:4644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4644-130-0x00000000029C0000-0x00000000029CC000-memory.dmp

Filesize
48KB

Download
memory/4644-134-0x0000000040000000-0x0000000040009000-memory.dmp

Filesize
36KB

Download
memory/4644-137-0x00000000030E0000-0x00000000030E9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing