Analysis

  • max time kernel
    67s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-03-2021 22:02

General

  • Target

    Private file #3741119.xls

  • Size

    90KB

  • MD5

    764d3e3bf1bd4c9fe1a06e6c7ce511cd

  • SHA1

    95e56031bf5ddb9b5aeed9e9f1d2d92410f69490

  • SHA256

    ddd23286a06e4a24ae80188fd959f6f1aff568c133c27e74b5ff98b14695ff70

  • SHA512

    5008a03926dd1420883ca172dc2dd28c6cb807813a38ceb16630742a35b1fad83a4014e829e811d13f3538df993cb59f869438992b6b9de152f44eff04565b14

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://techlog.xyz/page.icore

Extracted

Family

buer

C2

miyfandecompany.com

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Buer Loader 1 IoCs

    Detects Buer loader in memory or disk.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 8 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Private file #3741119.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe process call create C:\Users\Public\neiq.auw
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      PID:816
  • C:\Users\Public\neiq.auw
    C:\Users\Public\neiq.auw
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Public\neiq.auw
      C:\Users\Public\neiq.auw
      2⤵
      • Executes dropped EXE
      PID:1332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1332-14-0x0000000040000000-0x000000004000A000-memory.dmp

    Filesize

    40KB

  • memory/1740-8-0x0000000075C31000-0x0000000075C33000-memory.dmp

    Filesize

    8KB

  • memory/1784-5-0x000007FEF6B90000-0x000007FEF6E0A000-memory.dmp

    Filesize

    2.5MB

  • memory/2028-2-0x000000002F041000-0x000000002F044000-memory.dmp

    Filesize

    12KB

  • memory/2028-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2028-3-0x0000000071D11000-0x0000000071D13000-memory.dmp

    Filesize

    8KB

  • memory/2028-15-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB