General

  • Target

    Notice_Deliv_1.xlsm

  • Size

    430KB

  • Sample

    201211-4y7sxhsd7j

  • MD5

    5438405d03af55151af553812a1275cf

  • SHA1

    d00ffc475f4b54ab0a96a494018be43b08fffbf9

  • SHA256

    553cdc00fc3f98f0aa58936a890cd45cce84cb9ddaeee647459a98a32c2e219d

  • SHA512

    073a9c07118e8354d0b435885bb26e8f376b1ed09ac4aa85755eed3901b2c808edeafc895280acb77dc329050be590ff5a5be5f405c8d312e228efeadcd2471a

Score
10/10

Malware Config

Extracted

Family

buer

C2

heartprogseds.com

Targets

    • Target

      Notice_Deliv_1.xlsm

    • Size

      430KB

    • MD5

      5438405d03af55151af553812a1275cf

    • SHA1

      d00ffc475f4b54ab0a96a494018be43b08fffbf9

    • SHA256

      553cdc00fc3f98f0aa58936a890cd45cce84cb9ddaeee647459a98a32c2e219d

    • SHA512

      073a9c07118e8354d0b435885bb26e8f376b1ed09ac4aa85755eed3901b2c808edeafc895280acb77dc329050be590ff5a5be5f405c8d312e228efeadcd2471a

    Score
    10/10
    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks