buer | d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23

General

Target

StolenImagesEvidence.xlsm
Size

2.7MB
MD5

19e4dc06d4ccb13ede93bd8a3f115848
SHA1

f6f89dd11b43563abfbe19572d61168ab95825ee
SHA256

d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23
SHA512

12bf4eb62cda66cd25aeb8ee9f0e6ba7e6633b7bcf424ed321f7f7f0f0e6279ec4470a06ddd95eb431d843eb0805b10dac8e7eeba7bda6803f287d1a9fd7d960

Score

10^/10

buer loader persistence

Malware Config

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

gennt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e0fb894d1ddbd54172ba\\gennt.exe\""	gennt.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cscript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3980	3768	cscript.exe	EXCEL.EXE

Blocklisted process makes network request 1 IoCs

Processes:

cscript.exe

flow pid process

19 3980 cscript.exe
Executes dropped EXE 2 IoCs

Processes:

honey.exegennt.exe

pid process

3704 honey.exe
3740 gennt.exe

flow	pid	process
19	3980	cscript.exe

pid	process
3704	honey.exe
3740	gennt.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 3 IoCs

Processes:

EXCEL.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\mm:Zone.Identifier	EXCEL.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\xx:Zone.Identifier	EXCEL.EXE
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3768 EXCEL.EXE

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE
3768	EXCEL.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

EXCEL.EXEcscript.exehoney.exegennt.exe

description	pid	process	target process
PID 3768 wrote to memory of 3980	3768	EXCEL.EXE	cscript.exe
PID 3768 wrote to memory of 3980	3768	EXCEL.EXE	cscript.exe
PID 3980 wrote to memory of 3704	3980	cscript.exe	honey.exe
PID 3980 wrote to memory of 3704	3980	cscript.exe	honey.exe
PID 3980 wrote to memory of 3704	3980	cscript.exe	honey.exe
PID 3704 wrote to memory of 3740	3704	honey.exe	gennt.exe
PID 3704 wrote to memory of 3740	3704	honey.exe	gennt.exe
PID 3704 wrote to memory of 3740	3704	honey.exe	gennt.exe
PID 3740 wrote to memory of 3724	3740	gennt.exe	secinit.exe
PID 3740 wrote to memory of 3724	3740	gennt.exe	secinit.exe
PID 3740 wrote to memory of 3724	3740	gennt.exe	secinit.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\StolenImagesEvidence.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\programdata\honey.exe
    C:\programdata\honey.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe
      C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe "C:\programdata\honey.exe" ensgJJ
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Windows\SysWOW64\secinit.exe
        
        C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe
        5⤵
        
        PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe

MD5
f500854e3cf9556688203a3d869b7d6d

SHA1
281aab2eb26f31cf2255e2f5a467fc5eebda8df8

SHA256
471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975

SHA512
bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4

Download Submit
C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe

MD5
f500854e3cf9556688203a3d869b7d6d

SHA1
281aab2eb26f31cf2255e2f5a467fc5eebda8df8

SHA256
471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975

SHA512
bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4

Download Submit
C:\ProgramData\honey.exe

MD5
f500854e3cf9556688203a3d869b7d6d

SHA1
281aab2eb26f31cf2255e2f5a467fc5eebda8df8

SHA256
471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975

SHA512
bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4

Download Submit
C:\programdata\asc.txt:script1.vbs

MD5
db247f41725eccc95440e0de0cb454b0

SHA1
c18af0fcdf083be64fa139e1120b1526ba45d7b6

SHA256
f65cf77551c4c20c63985a74e7886651ec063996b0fc8e1a486801e27a9bdb88

SHA512
f5c4569e6d729885c55cd129461795dc96fa5efdb1e85a99282b149003c785272e148f6a728f66398f3364c9354af1393df7c5e0f2582112dfd4e7d7045c6f5a

Download Submit
C:\programdata\honey.exe

MD5
f500854e3cf9556688203a3d869b7d6d

SHA1
281aab2eb26f31cf2255e2f5a467fc5eebda8df8

SHA256
471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975

SHA512
bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4

Download Submit
memory/3704-8-0x0000000000000000-mapping.dmp

Download
memory/3740-11-0x0000000000000000-mapping.dmp

Download
memory/3768-3-0x000002BD44FE5000-0x000002BD44FEB000-memory.dmp

Filesize
24KB

Download
memory/3768-5-0x000002BD4C326000-0x000002BD4C32B000-memory.dmp

Filesize
20KB

Download
memory/3768-4-0x000002BD4C324000-0x000002BD4C326000-memory.dmp

Filesize
8KB

Download
memory/3768-0-0x000002BD4BFC9000-0x000002BD4BFCE000-memory.dmp

Filesize
20KB

Download
memory/3768-2-0x000002BD4C324000-0x000002BD4C326000-memory.dmp

Filesize
8KB

Download
memory/3768-1-0x000002BD44FE5000-0x000002BD44FEB000-memory.dmp

Filesize
24KB

Download
memory/3980-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads