General

  • Target

    Notice-Delivery2020.xlsm

  • Size

    430KB

  • Sample

    201211-k4cjmrwa4n

  • MD5

    0b49c3bd2479bed644ee5f0a21bdeabb

  • SHA1

    2f63381e01e5c6c2dd0b2759a645c7aae6019a49

  • SHA256

    711a05c2b42db93458407fc8d81cdd8d5c92a5cf44e5cab4e9ca58f5267d3cab

  • SHA512

    9d3b2e7d253b18a3cdcd05f908c8826e33401bb34ece07d42f0ee0f53b5f9d1a66f85459990bdf43401a8970e9d4cbe5c482f2578fcbec9994dbebaacb95a459

Score
10/10

Malware Config

Extracted

Family

buer

C2

heartprogseds.com

Targets

    • Target

      Notice-Delivery2020.xlsm

    • Size

      430KB

    • MD5

      0b49c3bd2479bed644ee5f0a21bdeabb

    • SHA1

      2f63381e01e5c6c2dd0b2759a645c7aae6019a49

    • SHA256

      711a05c2b42db93458407fc8d81cdd8d5c92a5cf44e5cab4e9ca58f5267d3cab

    • SHA512

      9d3b2e7d253b18a3cdcd05f908c8826e33401bb34ece07d42f0ee0f53b5f9d1a66f85459990bdf43401a8970e9d4cbe5c482f2578fcbec9994dbebaacb95a459

    Score
    10/10
    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks