General

  • Target

    Invoice.xlsb

  • Size

    155KB

  • Sample

    201215-pamdz1smme

  • MD5

    18cb83fa82fb14788d5a1cbafcd9bb28

  • SHA1

    4b61151831eedeb225166c30c2e2b555c9e5b5d0

  • SHA256

    45cc417aeb30d7aaba675077c10f70d66ee9b1b8b4820f0469221f0a87fe9545

  • SHA512

    123acdaeb7baeb1bfe5284a70d920f692ff97927fe05cbbf56b029c93684aea5429c7e619a8a3ea2e55136d8398777f0e0b134cfe27e61b92acda0acf3ec5b4e

Score
10/10

Malware Config

Extracted

Family

buer

C2

softwareconsbank.com

Targets

    • Target

      Invoice.xlsb

    • Size

      155KB

    • MD5

      18cb83fa82fb14788d5a1cbafcd9bb28

    • SHA1

      4b61151831eedeb225166c30c2e2b555c9e5b5d0

    • SHA256

      45cc417aeb30d7aaba675077c10f70d66ee9b1b8b4820f0469221f0a87fe9545

    • SHA512

      123acdaeb7baeb1bfe5284a70d920f692ff97927fe05cbbf56b029c93684aea5429c7e619a8a3ea2e55136d8398777f0e0b134cfe27e61b92acda0acf3ec5b4e

    Score
    10/10
    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks