buer | 1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9

General

Target

1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe
Size

144KB
MD5

37d8bced898bf955130f39645eba3f0a
SHA1

c411ffa43ad7cf7bf321017e9a2d7d9bae1f0cf5
SHA256

1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9
SHA512

1ae8c515a0a820552c8861fdde197dee0ea0f7fabae74ee4fac9c345f0e1dadf5448b0787cbedfa9e960980419dd3f59fbb8cae8da84df74283348ac80554eaa

Score

10^/10

buer loader

Family

buer

C2

https://rawcookies.ru/

https://westkingz.ru/

Buer Loader 7 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral1/memory/2000-60-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral1/memory/2000-67-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral1/memory/2000-64-0x0000000040003030-mapping.dmp	buer
behavioral1/memory/2000-63-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral1/memory/2000-62-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral1/memory/2000-61-0x0000000040000000-0x000000004000C000-memory.dmp	buer
behavioral1/memory/2000-68-0x0000000040000000-0x000000004000C000-memory.dmp	buer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27
PID 1276 wrote to memory of 2000	1276	1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe	27

C:\Users\Admin\AppData\Local\Temp\1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe
"C:\Users\Admin\AppData\Local\Temp\1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\1c6852799eabf0c9e744016a3113af6d1185c3de41acdbf90c95297d252d01f9.exe
  "{path}"
  2⤵
  PID:2000

memory/1276-54-0x0000000000B00000-0x0000000000B2A000-memory.dmp

Filesize
168KB

Download
memory/1276-55-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/1276-56-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download
memory/2000-60-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-67-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-66-0x0000000075A61000-0x0000000075A63000-memory.dmp

Filesize
8KB

Download
memory/2000-63-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-62-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-61-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-58-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-57-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download
memory/2000-68-0x0000000040000000-0x000000004000C000-memory.dmp

Filesize
48KB

Download