buer | 1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa | Triage

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 18:08

Sharing

Report Analysis Logs

General

Target

1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa.exe
Size

368KB
MD5

345c37943c7a7e1fd0098aab07fe3c86
SHA1

ff8d484c90feab90b94502fbcaff84b16eb9a280
SHA256

1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa
SHA512

888e8d2f20ccf440107971e8268d06b34aa8c7e5c476f55544321780f30af52c731ada5cca83f015b607f3b61dc5be276199a9dd3cc50fd70ed47c38ca5495cd

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

https://162.244.81.87/

http://162.244.81.87:8080/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 2 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/1836-55-0x0000000000300000-0x000000000030C000-memory.dmp	buer
behavioral1/memory/1836-59-0x00000000002F0000-0x00000000002FA000-memory.dmp	buer

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1836	1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa.exe
1836	1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa.exe

C:\Users\Admin\AppData\Local\Temp\1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa.exe
"C:\Users\Admin\AppData\Local\Temp\1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1836-55-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/1836-59-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download