Analysis

  • max time kernel
    44s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 09:51

General

  • Target

    7cf42b86ce5e7da39da70e7a4ec975cb6c3688201cf4160033c3ead411114b3b.exe

  • Size

    297KB

  • MD5

    93635db616729ba0c3b625e46e91df4c

  • SHA1

    452e4f91c12052852bb20649734a917f4360a810

  • SHA256

    7cf42b86ce5e7da39da70e7a4ec975cb6c3688201cf4160033c3ead411114b3b

  • SHA512

    c3bd159c1a4cce8e6ff3190453cebea30e24579738403ed17c1f3984df7c6502f66f14901df7ac5767f8aa61b42a2f7d60fbc22eeb4912e55ceb6c727ad7f309

Score
10/10

Malware Config

Extracted

Family

buer

C2

http://koralak.hk/

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Buer Loader 3 IoCs

    Detects Buer loader in memory or disk.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cf42b86ce5e7da39da70e7a4ec975cb6c3688201cf4160033c3ead411114b3b.exe
    "C:\Users\Admin\AppData\Local\Temp\7cf42b86ce5e7da39da70e7a4ec975cb6c3688201cf4160033c3ead411114b3b.exe"
    1⤵
      PID:564

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/564-54-0x0000000000548000-0x000000000054F000-memory.dmp

      Filesize

      28KB

    • memory/564-56-0x0000000000020000-0x0000000000029000-memory.dmp

      Filesize

      36KB

    • memory/564-55-0x0000000000548000-0x000000000054F000-memory.dmp

      Filesize

      28KB

    • memory/564-57-0x0000000040000000-0x0000000040533000-memory.dmp

      Filesize

      5.2MB

    • memory/564-58-0x0000000040000000-0x0000000040533000-memory.dmp

      Filesize

      5.2MB