Analysis
-
max time kernel
38s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
-
submitted
24-07-2022 17:22
General
-
Target
ca8f4594a6800a308c5cbc8c6325e958e42dd4cf539ad4e01362dcc1ec20142b.exe
-
Size
1.5MB
-
MD5
6943e6fa21cf64f70bccdf137160b9ca
-
SHA1
e0d5fe545d1d17dd1e06f21b6767fb2a20df2e86
-
SHA256
ca8f4594a6800a308c5cbc8c6325e958e42dd4cf539ad4e01362dcc1ec20142b
-
SHA512
6e83cb6001bcca7f7376f80e215671a0210e8fc5670a28d7b8373b02d831d3c7b4adaab85b5596d5d7ebe89fce2f75975d6e9a5446f0cf05d0c6d2c50b50d99a
Score
10/10
Malware Config
Extracted
Family
buer
C2
https://loddd01.info/
https://loddd02.info/
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca8f4594a6800a308c5cbc8c6325e958e42dd4cf539ad4e01362dcc1ec20142b.exe"C:\Users\Admin\AppData\Local\Temp\ca8f4594a6800a308c5cbc8c6325e958e42dd4cf539ad4e01362dcc1ec20142b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
1.5MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
1.5MB
-
Filesize
3.9MB