Overview

overview

10

Static

static

3

362073a5ce...18.exe

windows7-x64

10

362073a5ce...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    362073a5ce3273ad4dcfc8e6c47ec3ca_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240511-xyldsaga94

  • MD5

    362073a5ce3273ad4dcfc8e6c47ec3ca

  • SHA1

    7948c767c9d666b4fd73d7b6180c5fd78c302ac1

  • SHA256

    e569998290b8e57cbfeea4f35425d6c79e4a6cf1bf56b316c01d8f91d269396f

  • SHA512

    15d048fbb1ab5da75818a1ea21a1d7ed4f97b394281c677c7e7a08c1291cb514500ef3078ae358d1e1eb5c9bb294ebacf075f3b3b40631bce01c92d8f00c0377

  • SSDEEP

    49152:niHexSQINK8mkzI+xNPfCH+CjIcZWzjR:niHfpNNMkpqHbIZ

Score
10/10
buerevasionloader

Malware Config

Extracted

Family

buer

C2

https://loddd01.info/

https://loddd02.info/

Targets

    • Target

      362073a5ce3273ad4dcfc8e6c47ec3ca_JaffaCakes118

    • Size

      1.6MB

    • MD5

      362073a5ce3273ad4dcfc8e6c47ec3ca

    • SHA1

      7948c767c9d666b4fd73d7b6180c5fd78c302ac1

    • SHA256

      e569998290b8e57cbfeea4f35425d6c79e4a6cf1bf56b316c01d8f91d269396f

    • SHA512

      15d048fbb1ab5da75818a1ea21a1d7ed4f97b394281c677c7e7a08c1291cb514500ef3078ae358d1e1eb5c9bb294ebacf075f3b3b40631bce01c92d8f00c0377

    • SSDEEP

      49152:niHexSQINK8mkzI+xNPfCH+CjIcZWzjR:niHfpNNMkpqHbIZ

    Score
    10/10
    buerevasionloader

    • Buer

      Buer is a new modular loader first seen in August 2019.

      loaderbuer

    • Buer Loader

      Detects Buer loader in memory or disk.

      loader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks