Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-05-2022 23:40
General
-
Target
0807f543bc8322a5c55739c0a46aa8912feb5d3c8785b36188f9eb9e8b5e6af0.exe
-
Size
1.7MB
-
MD5
3e397d12e8dc5a6194c6c275977f8bba
-
SHA1
2aa3297e700208a43cad912c69aa5ff1f9435bce
-
SHA256
0807f543bc8322a5c55739c0a46aa8912feb5d3c8785b36188f9eb9e8b5e6af0
-
SHA512
6f0fba2a65073e0e8f526c4bfd0a24ae130a68c3f21b49595afc2bd4fd9c7d9f4661312f356011fae3ee626ffcb2ca364046e7fbc947f90d11719593a2ba9453
Score
10/10
Malware Config
Extracted
Family
buer
C2
https://loddd01.info/
https://loddd02.info/
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0807f543bc8322a5c55739c0a46aa8912feb5d3c8785b36188f9eb9e8b5e6af0.exe"C:\Users\Admin\AppData\Local\Temp\0807f543bc8322a5c55739c0a46aa8912feb5d3c8785b36188f9eb9e8b5e6af0.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
-
Filesize
1.5MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.5MB
-
Filesize
4.4MB