buer | 6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

General

Target

6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
Size

3.9MB
MD5

01644c1081aaa09a39deb82c7bcc48a7
SHA1

0522a3fed1b3d73029e6494e4e3b1019ee40a48d
SHA256

6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c
SHA512

b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

http://burload01.top/

http://burload02.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 1 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral2/memory/2244-143-0x000000003F4D0000-0x000000004063F000-memory.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
4512	errorResponder.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
4512	errorResponder.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
4512	errorResponder.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4512	2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	85
PID 2244 wrote to memory of 4512	2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	85
PID 2244 wrote to memory of 4512	2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	85
PID 2244 wrote to memory of 4512	2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	85
PID 2244 wrote to memory of 4512	2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	85
PID 2244 wrote to memory of 4512	2244	6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe	85

C:\Users\Admin\AppData\Local\Temp\6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe
"C:\Users\Admin\AppData\Local\Temp\6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\ProgramData\ErrorResponder\errorResponder.exe
  C:\ProgramData\ErrorResponder\errorResponder.exe "C:\Users\Admin\AppData\Local\Temp\6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c.exe" ensgJJ
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ErrorResponder\errorResponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
C:\ProgramData\ErrorResponder\errorResponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
memory/2244-133-0x000000007EE90000-0x000000007F261000-memory.dmp

Filesize
3.8MB

Download
memory/2244-130-0x000000003F4D0000-0x000000004063F000-memory.dmp

Filesize
17.4MB

Download
memory/2244-132-0x000000003F4D0000-0x000000004063F000-memory.dmp

Filesize
17.4MB

Download
memory/2244-131-0x000000007EE90000-0x000000007F261000-memory.dmp

Filesize
3.8MB

Download
memory/2244-139-0x000000007EE90000-0x000000007F261000-memory.dmp

Filesize
3.8MB

Download
memory/2244-143-0x000000003F4D0000-0x000000004063F000-memory.dmp

Filesize
17.4MB

Download
memory/4512-137-0x000000003F0E0000-0x000000004024F000-memory.dmp

Filesize
17.4MB

Download
memory/4512-138-0x0000000000E60000-0x0000000000EEE000-memory.dmp

Filesize
568KB

Download
memory/4512-140-0x000000007F970000-0x000000007FD41000-memory.dmp

Filesize
3.8MB

Download
memory/4512-141-0x0000000000E60000-0x0000000000EEE000-memory.dmp

Filesize
568KB

Download
memory/4512-142-0x000000003F0E0000-0x000000004024F000-memory.dmp

Filesize
17.4MB

Download

Analysis

Sharing