Analysis
-
max time kernel
26s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
31-07-2022 09:54
General
-
Target
fc3c68e9d36d703376fb466cc0126e5bedddda08170a2b41d297ff6dd5cfc23b.exe
-
Size
1.6MB
-
MD5
3c9c8fd4ce120ff1b2e7bf1b5d6a2dd3
-
SHA1
73fdcf58ecee325c35e9904ddd88508cd539251a
-
SHA256
fc3c68e9d36d703376fb466cc0126e5bedddda08170a2b41d297ff6dd5cfc23b
-
SHA512
00a2cf1592f6e8f7135187691506ff03d61e3d36f34db800b7baeac566b960d798f03d567fd7b71787e7770a6b98c3bee718aa5bab0a7d63df1ad68d1e6b9ded
Score
10/10
Malware Config
Extracted
Family
buer
C2
http://loaadik01.pro/
http://loaadik02.pro/
Signatures
-
Buer
Buer is a new modular loader first seen in August 2019.
-
Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3c68e9d36d703376fb466cc0126e5bedddda08170a2b41d297ff6dd5cfc23b.exe"C:\Users\Admin\AppData\Local\Temp\fc3c68e9d36d703376fb466cc0126e5bedddda08170a2b41d297ff6dd5cfc23b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
-
Filesize
1.5MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB