buer | d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23

General

Target
StolenImagesEvidence.xlsm
Size 2.7MB
Sample200630-rdvmpwkhrx
SHA256 d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23
MD5 19e4dc06d4ccb13ede93bd8a3f115848
SHA1 f6f89dd11b43563abfbe19572d61168ab95825ee
SHA512 12bf4eb62cda66cd25aeb8ee9f0e6ba7e6633b7bcf424ed321f7f7f0f0e6279ec4470a06ddd95eb431d843eb0805b10dac8e7eeba7bda6803f287d1a9fd7d960
MD5 SHA1 SHA512

Score

10^/10

buer loader persistence

Malware Config

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e0fb894d1ddbd54172ba\\gennt.exe\""	gennt.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3980	3768	cscript.exe	65

Blocklisted process makes network request 1 IoCs

flow	pid	Process
19	3980	cscript.exe

Executes dropped EXE 2 IoCs

pid	Process
3704	honey.exe
3740	gennt.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\mm:Zone.Identifier	EXCEL.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\xx:Zone.Identifier	EXCEL.EXE
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3768	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3980	3768	EXCEL.EXE	72
PID 3768 wrote to memory of 3980	3768	EXCEL.EXE	72
PID 3980 wrote to memory of 3704	3980	cscript.exe	74
PID 3980 wrote to memory of 3704	3980	cscript.exe	74
PID 3980 wrote to memory of 3704	3980	cscript.exe	74
PID 3704 wrote to memory of 3740	3704	honey.exe	78
PID 3704 wrote to memory of 3740	3704	honey.exe	78
PID 3704 wrote to memory of 3740	3704	honey.exe	78
PID 3740 wrote to memory of 3724	3740	gennt.exe	79
PID 3740 wrote to memory of 3724	3740	gennt.exe	79
PID 3740 wrote to memory of 3724	3740	gennt.exe	79

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\StolenImagesEvidence.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\programdata\honey.exe
    C:\programdata\honey.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe
      C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe "C:\programdata\honey.exe" ensgJJ
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Windows\SysWOW64\secinit.exe
        
        C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe
        5⤵
        
        PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3768-3-0x000002BD44FE5000-0x000002BD44FEB000-memory.dmp

Download

memory/3768-5-0x000002BD4C326000-0x000002BD4C32B000-memory.dmp

Download

memory/3768-4-0x000002BD4C324000-0x000002BD4C326000-memory.dmp

Download

memory/3768-0-0x000002BD4BFC9000-0x000002BD4BFCE000-memory.dmp

Download

memory/3768-2-0x000002BD4C324000-0x000002BD4C326000-memory.dmp

Download

memory/3768-1-0x000002BD44FE5000-0x000002BD44FEB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads