buer | 8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de

General

Target

8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
Size

1.6MB
MD5

6a8d2eda7035eeb6082ae635ce2429e5
SHA1

d790b191fb6478f458af6a4ac5bfa5d3bcc3001d
SHA256

8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de
SHA512

986a4e181bd1749415ce63a10671db49a7b758f1ed5f604a54bcdc75eab69f3336adff189a65ddf6bb7502b37c898143797ca050b6c5c742bb6ae70bb8c6734a

Score

10^/10

buer evasion loader

Malware Config

Extracted

Family

buer

C2

https://loddd01.info/

https://loddd02.info/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 7 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral2/memory/4512-132-0x000000003F020000-0x000000003F471000-memory.dmp	buer
behavioral2/memory/4512-133-0x000000003F020000-0x000000003F471000-memory.dmp	buer
behavioral2/memory/4512-134-0x000000003F020000-0x000000003F471000-memory.dmp	buer
behavioral2/memory/4512-138-0x000000003F020000-0x000000003F471000-memory.dmp	buer
behavioral2/memory/2664-142-0x000000003F2F0000-0x000000003F741000-memory.dmp	buer
behavioral2/memory/2664-143-0x000000003F2F0000-0x000000003F741000-memory.dmp	buer
behavioral2/memory/2664-144-0x000000003F2F0000-0x000000003F741000-memory.dmp	buer

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	plugin.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	plugin.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	plugin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	plugin.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Wine	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
Key opened	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Wine	plugin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4512	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
2664	plugin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4512	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
4512	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
2664	plugin.exe
2664	plugin.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2664	4512	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe	81
PID 4512 wrote to memory of 2664	4512	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe	81
PID 4512 wrote to memory of 2664	4512	8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe	81

C:\Users\Admin\AppData\Local\Temp\8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe
"C:\Users\Admin\AppData\Local\Temp\8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\ProgramData\UBlockPlugin\plugin.exe
  C:\ProgramData\UBlockPlugin\plugin.exe "C:\Users\Admin\AppData\Local\Temp\8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de.exe" ensgJJ
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\UBlockPlugin\plugin.exe

Filesize
1.6MB

MD5
6a8d2eda7035eeb6082ae635ce2429e5

SHA1
d790b191fb6478f458af6a4ac5bfa5d3bcc3001d

SHA256
8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de

SHA512
986a4e181bd1749415ce63a10671db49a7b758f1ed5f604a54bcdc75eab69f3336adff189a65ddf6bb7502b37c898143797ca050b6c5c742bb6ae70bb8c6734a

Download Submit
C:\ProgramData\UBlockPlugin\plugin.exe

Filesize
1.6MB

MD5
6a8d2eda7035eeb6082ae635ce2429e5

SHA1
d790b191fb6478f458af6a4ac5bfa5d3bcc3001d

SHA256
8348ec102670bb9c2445dc6fc179dcfdf650ec398ef71cb39056566236a2a5de

SHA512
986a4e181bd1749415ce63a10671db49a7b758f1ed5f604a54bcdc75eab69f3336adff189a65ddf6bb7502b37c898143797ca050b6c5c742bb6ae70bb8c6734a

Download Submit
memory/2664-140-0x000000003F2F0000-0x000000003F741000-memory.dmp

Filesize
4.3MB

Download
memory/2664-144-0x000000003F2F0000-0x000000003F741000-memory.dmp

Filesize
4.3MB

Download
memory/2664-143-0x000000003F2F0000-0x000000003F741000-memory.dmp

Filesize
4.3MB

Download
memory/2664-142-0x000000003F2F0000-0x000000003F741000-memory.dmp

Filesize
4.3MB

Download
memory/2664-141-0x0000000077A60000-0x0000000077C03000-memory.dmp

Filesize
1.6MB

Download
memory/4512-133-0x000000003F020000-0x000000003F471000-memory.dmp

Filesize
4.3MB

Download
memory/4512-138-0x000000003F020000-0x000000003F471000-memory.dmp

Filesize
4.3MB

Download
memory/4512-139-0x0000000077A60000-0x0000000077C03000-memory.dmp

Filesize
1.6MB

Download
memory/4512-134-0x000000003F020000-0x000000003F471000-memory.dmp

Filesize
4.3MB

Download
memory/4512-130-0x000000003F020000-0x000000003F471000-memory.dmp

Filesize
4.3MB

Download
memory/4512-132-0x000000003F020000-0x000000003F471000-memory.dmp

Filesize
4.3MB

Download
memory/4512-131-0x0000000077A60000-0x0000000077C03000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads