buer | 6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

General

Target

6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
Size

3.9MB
MD5

01644c1081aaa09a39deb82c7bcc48a7
SHA1

0522a3fed1b3d73029e6494e4e3b1019ee40a48d
SHA256

6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c
SHA512

b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

http://burload01.top/

http://burload02.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 3 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral1/memory/1696-55-0x000000003FEF0000-0x000000004105F000-memory.dmp	buer
behavioral1/memory/1696-57-0x000000003FEF0000-0x000000004105F000-memory.dmp	buer
behavioral1/memory/1696-71-0x000000003FEF0000-0x000000004105F000-memory.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
628	errorResponder.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
628	errorResponder.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
628	errorResponder.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28
PID 1696 wrote to memory of 628	1696	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	28

C:\Users\Admin\AppData\Local\Temp\6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
"C:\Users\Admin\AppData\Local\Temp\6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\ProgramData\ErrorResponder\errorResponder.exe
  C:\ProgramData\ErrorResponder\errorResponder.exe "C:\Users\Admin\AppData\Local\Temp\6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe" ensgJJ
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ErrorResponder\errorResponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
\??\c:\programdata\errorresponder\errorresponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
\ProgramData\ErrorResponder\errorResponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
memory/628-68-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/628-58-0x0000000000050000-0x00000000000DE000-memory.dmp

Filesize
568KB

Download
memory/628-65-0x000000003F0A0000-0x000000004020F000-memory.dmp

Filesize
17.4MB

Download
memory/628-66-0x0000000000050000-0x00000000000DE000-memory.dmp

Filesize
568KB

Download
memory/628-69-0x0000000000050000-0x00000000000DE000-memory.dmp

Filesize
568KB

Download
memory/628-70-0x000000003F0A0000-0x000000004020F000-memory.dmp

Filesize
17.4MB

Download
memory/1696-57-0x000000003FEF0000-0x000000004105F000-memory.dmp

Filesize
17.4MB

Download
memory/1696-56-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1696-64-0x0000000003F30000-0x000000000509F000-memory.dmp

Filesize
17.4MB

Download
memory/1696-55-0x000000003FEF0000-0x000000004105F000-memory.dmp

Filesize
17.4MB

Download
memory/1696-54-0x0000000075371000-0x0000000075373000-memory.dmp

Filesize
8KB

Download
memory/1696-71-0x000000003FEF0000-0x000000004105F000-memory.dmp

Filesize
17.4MB

Download

Analysis

Sharing