Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
24-07-2022 22:36
General
-
Target
d2930279448fd7ae1432dfe5d1de37c9e5c924e5466ab49763e8de671b24c511.exe
-
Size
1.6MB
-
MD5
27eff943a9a321407709d92ef5f99667
-
SHA1
1c6a9de56ae6db79d1ade91876baeda42c0d3819
-
SHA256
d2930279448fd7ae1432dfe5d1de37c9e5c924e5466ab49763e8de671b24c511
-
SHA512
f43a9781e3148105682237897682dd8f289fb4cbb1f21e4e329ece0d04ee0f903a6f664cd7fa5a3d9ccdcbfe96ba37e5d79e909fc84b12ba426dcf03024590f3
Score
10/10
Malware Config
Extracted
Family
buer
C2
https://loddd01.info/
https://loddd02.info/
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2930279448fd7ae1432dfe5d1de37c9e5c924e5466ab49763e8de671b24c511.exe"C:\Users\Admin\AppData\Local\Temp\d2930279448fd7ae1432dfe5d1de37c9e5c924e5466ab49763e8de671b24c511.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
-
Filesize
1.5MB
-
Filesize
4.2MB