buer | 6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

General

Target

01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
Size

3.9MB
MD5

01644c1081aaa09a39deb82c7bcc48a7
SHA1

0522a3fed1b3d73029e6494e4e3b1019ee40a48d
SHA256

6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c
SHA512

b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0
SSDEEP

98304:iq2jZUD9cGCMIcGDJxgQgEZjAgDZIuIsYOY1sFiAJ8:i5jZUDxIXuJEpNlIuZY1giT

Score

10^/10

buer loader

Malware Config

Extracted

Family

buer

C2

http://burload01.top/

http://burload02.top/

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Buer Loader 8 IoCs

Detects Buer loader in memory or disk.

loader

resource	yara_rule
behavioral2/memory/3196-9-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-10-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-11-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-13-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-14-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-15-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-19-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer
behavioral2/memory/3196-29-0x000000003F4E0000-0x000000004064F000-memory.dmp	buer

Executes dropped EXE 1 IoCs

pid	Process
3704	errorResponder.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3704	errorResponder.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
3704	errorResponder.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3704	3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	89
PID 3196 wrote to memory of 3704	3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	89
PID 3196 wrote to memory of 3704	3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	89
PID 3196 wrote to memory of 3704	3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	89
PID 3196 wrote to memory of 3704	3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	89
PID 3196 wrote to memory of 3704	3196	01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196
- C:\ProgramData\ErrorResponder\errorResponder.exe
  C:\ProgramData\ErrorResponder\errorResponder.exe "C:\Users\Admin\AppData\Local\Temp\01644c1081aaa09a39deb82c7bcc48a7_JaffaCakes118.exe" ensgJJ
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ErrorResponder\errorResponder.exe

Filesize
3.9MB

MD5
01644c1081aaa09a39deb82c7bcc48a7

SHA1
0522a3fed1b3d73029e6494e4e3b1019ee40a48d

SHA256
6160f3966660b788ea437d5d202547e54d7532582be55d0d93c37860e912111c

SHA512
b403ed4cd7b93fbfe4419eac7afa88d57307bbaef8a19edcca55bd3c9f99847186a014722706ba949dad3f4f35f3988dbe02e3e547b80b943275ebc59f58e5d0

Download Submit
memory/3196-14-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-10-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-13-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-8-0x000000007F210000-0x000000007F5E1000-memory.dmp

Filesize
3.8MB

Download
memory/3196-4-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3196-3-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3196-2-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3196-1-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3196-9-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-15-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-11-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-12-0x000000007F210000-0x000000007F5E1000-memory.dmp

Filesize
3.8MB

Download
memory/3196-5-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3196-6-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3196-0-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-7-0x0000000077933000-0x0000000077934000-memory.dmp

Filesize
4KB

Download
memory/3196-29-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3196-19-0x000000003F4E0000-0x000000004064F000-memory.dmp

Filesize
17.4MB

Download
memory/3704-32-0x000000003FCE0000-0x0000000040E4F000-memory.dmp

Filesize
17.4MB

Download
memory/3704-27-0x0000000077932000-0x0000000077933000-memory.dmp

Filesize
4KB

Download
memory/3704-26-0x000000003FCE0000-0x0000000040E4F000-memory.dmp

Filesize
17.4MB

Download
memory/3704-28-0x0000000077933000-0x0000000077934000-memory.dmp

Filesize
4KB

Download
memory/3704-23-0x00000000008F0000-0x000000000097E000-memory.dmp

Filesize
568KB

Download
memory/3704-17-0x00000000008F0000-0x000000000097E000-memory.dmp

Filesize
568KB

Download
memory/3704-30-0x00000000008F0000-0x000000000097E000-memory.dmp

Filesize
568KB

Download
memory/3704-25-0x00000000008F0000-0x000000000097E000-memory.dmp

Filesize
568KB

Download
memory/3704-24-0x00000000008F0000-0x000000000097E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing