Overview

overview

10

Static

static

Invoice_8003346.xlsm

windows7_x64

10

Invoice_8003346.xlsm

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-03-2021 20:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice_8003346.xlsm

Score
10/10
buerloader

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://safedot.digital/pp

Extracted

Family

buer

C2

verstudiosan.com

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer
  • Buer Loader 1 IoCs

    Detects Buer loader in memory or disk.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 10 IoCs
    installer
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice_8003346.xlsm
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\dswekerjs\dljffsrd\ServApi.exe
      "C:\dswekerjs\dljffsrd\ServApi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\dswekerjs\dljffsrd\ServApi.exe
        "C:\dswekerjs\dljffsrd\ServApi.exe"
        3⤵
        • Executes dropped EXE
        PID:1456

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1456-16-0x0000000040000000-0x0000000040009000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1608-10-0x0000000075781000-0x0000000075783000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1752-6-0x000007FEF6080000-0x000007FEF62FA000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/1888-5-0x0000000005450000-0x0000000005452000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1888-2-0x000000002F8C1000-0x000000002F8C4000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1888-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1888-3-0x0000000071271000-0x0000000071273000-memory.dmp

    Filesize

    8KB

    Download