rustybuer | 7bc840f3e200c5c877b411614a96a364f5402060db380a7691aeaabff18b602c

General

Target

invoice_document.docm
Size

3.3MB
MD5

b0527860dce067ded04f8ed8cf99b7c1
SHA1

4827966bf79e78991d8c1d94a1a2ff1d71ab371a
SHA256

7bc840f3e200c5c877b411614a96a364f5402060db380a7691aeaabff18b602c
SHA512

3a506e49670bfeebdd1154130063f091e4c48b365986042a43cba3aeddb180ae4df709012b935b9ee1d6de2f65887b5637f87e8a29e8461abf48242100c8134b

Score

10^/10

rustybuer loader

Malware Config

Extracted

Family

rustybuer

C2

https://orderverification-api.com/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3220	4032	rundll32.exe	WINWORD.EXE

RustyBuer
RustyBuer is a new variant of Buer loader written in Rust.
loader rustybuer
Executes dropped EXE 2 IoCs

Processes:

OfficeVerif.exeOfficeVerif.exe

pid process

3584 OfficeVerif.exe
3260 OfficeVerif.exe
Loads dropped DLL 1 IoCs

Processes:

OfficeVerif.exe

pid process

3584 OfficeVerif.exe

pid	process
3584	OfficeVerif.exe
3260	OfficeVerif.exe

pid	process
3584	OfficeVerif.exe

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

OfficeVerif.exe

description	ioc	process
File opened (read-only)	\??\p:	OfficeVerif.exe
File opened (read-only)	\??\R:	OfficeVerif.exe
File opened (read-only)	\??\x:	OfficeVerif.exe
File opened (read-only)	\??\k:	OfficeVerif.exe
File opened (read-only)	\??\m:	OfficeVerif.exe
File opened (read-only)	\??\N:	OfficeVerif.exe
File opened (read-only)	\??\r:	OfficeVerif.exe
File opened (read-only)	\??\t:	OfficeVerif.exe
File opened (read-only)	\??\T:	OfficeVerif.exe
File opened (read-only)	\??\X:	OfficeVerif.exe
File opened (read-only)	\??\b:	OfficeVerif.exe
File opened (read-only)	\??\e:	OfficeVerif.exe
File opened (read-only)	\??\L:	OfficeVerif.exe
File opened (read-only)	\??\M:	OfficeVerif.exe
File opened (read-only)	\??\o:	OfficeVerif.exe
File opened (read-only)	\??\V:	OfficeVerif.exe
File opened (read-only)	\??\y:	OfficeVerif.exe
File opened (read-only)	\??\z:	OfficeVerif.exe
File opened (read-only)	\??\D:	OfficeVerif.exe
File opened (read-only)	\??\h:	OfficeVerif.exe
File opened (read-only)	\??\K:	OfficeVerif.exe
File opened (read-only)	\??\n:	OfficeVerif.exe
File opened (read-only)	\??\u:	OfficeVerif.exe
File opened (read-only)	\??\H:	OfficeVerif.exe
File opened (read-only)	\??\I:	OfficeVerif.exe
File opened (read-only)	\??\j:	OfficeVerif.exe
File opened (read-only)	\??\P:	OfficeVerif.exe
File opened (read-only)	\??\Q:	OfficeVerif.exe
File opened (read-only)	\??\S:	OfficeVerif.exe
File opened (read-only)	\??\v:	OfficeVerif.exe
File opened (read-only)	\??\W:	OfficeVerif.exe
File opened (read-only)	\??\a:	OfficeVerif.exe
File opened (read-only)	\??\B:	OfficeVerif.exe
File opened (read-only)	\??\Y:	OfficeVerif.exe
File opened (read-only)	\??\O:	OfficeVerif.exe
File opened (read-only)	\??\q:	OfficeVerif.exe
File opened (read-only)	\??\i:	OfficeVerif.exe
File opened (read-only)	\??\l:	OfficeVerif.exe
File opened (read-only)	\??\F:	OfficeVerif.exe
File opened (read-only)	\??\G:	OfficeVerif.exe
File opened (read-only)	\??\J:	OfficeVerif.exe
File opened (read-only)	\??\s:	OfficeVerif.exe
File opened (read-only)	\??\Z:	OfficeVerif.exe
File opened (read-only)	\??\A:	OfficeVerif.exe
File opened (read-only)	\??\E:	OfficeVerif.exe
File opened (read-only)	\??\U:	OfficeVerif.exe
File opened (read-only)	\??\w:	OfficeVerif.exe
File opened (read-only)	\??\f:	OfficeVerif.exe
File opened (read-only)	\??\g:	OfficeVerif.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

OfficeVerif.exe

description pid process target process

PID 3584 set thread context of 3260 3584 OfficeVerif.exe OfficeVerif.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3584 set thread context of 3260	3584	OfficeVerif.exe	OfficeVerif.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\ProgramData\OfficeVerif.exe	nsis_installer_1
C:\ProgramData\OfficeVerif.exe	nsis_installer_2
C:\ProgramData\OfficeVerif.exe	nsis_installer_1
C:\ProgramData\OfficeVerif.exe	nsis_installer_2
C:\ProgramData\OfficeVerif.exe	nsis_installer_1
C:\ProgramData\OfficeVerif.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4032 WINWORD.EXE
4032 WINWORD.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

OfficeVerif.exe

pid process

3584 OfficeVerif.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4032 WINWORD.EXE
4032 WINWORD.EXE
4032 WINWORD.EXE
4032 WINWORD.EXE
4032 WINWORD.EXE
4032 WINWORD.EXE
4032 WINWORD.EXE

pid	process
4032	WINWORD.EXE
4032	WINWORD.EXE

pid	process
3584	OfficeVerif.exe

pid	process
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE
4032	WINWORD.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WINWORD.EXErundll32.exeOfficeVerif.exe

description	pid	process	target process
PID 4032 wrote to memory of 3220	4032	WINWORD.EXE	rundll32.exe
PID 4032 wrote to memory of 3220	4032	WINWORD.EXE	rundll32.exe
PID 3220 wrote to memory of 3584	3220	rundll32.exe	OfficeVerif.exe
PID 3220 wrote to memory of 3584	3220	rundll32.exe	OfficeVerif.exe
PID 3220 wrote to memory of 3584	3220	rundll32.exe	OfficeVerif.exe
PID 3584 wrote to memory of 3260	3584	OfficeVerif.exe	OfficeVerif.exe
PID 3584 wrote to memory of 3260	3584	OfficeVerif.exe	OfficeVerif.exe
PID 3584 wrote to memory of 3260	3584	OfficeVerif.exe	OfficeVerif.exe
PID 3584 wrote to memory of 3260	3584	OfficeVerif.exe	OfficeVerif.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\invoice_document.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe shell32.dll,ShellExec_RunDLL C:\ProgramData\OfficeVerif.exe
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\ProgramData\OfficeVerif.exe
    "C:\ProgramData\OfficeVerif.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\ProgramData\OfficeVerif.exe
      "C:\ProgramData\OfficeVerif.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      PID:3260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OfficeVerif.exe

MD5
40cc80e562ea60f3e59a5fdadc1507da

SHA1
43a2232afd8a909934f974dda017a7954376de6a

SHA256
0737de4f747ee8260403c54b41b39125933680875bbe91f95d8522130489995c

SHA512
3c4c33c3b62d7101582b3af2a27443317d3158097c9e204f3fcfd2341eab7e45e479a034fbb451fff80e692751919ae43b07ad4aba4652ed545f225912f2aa1b

Download Submit
C:\ProgramData\OfficeVerif.exe

MD5
40cc80e562ea60f3e59a5fdadc1507da

SHA1
43a2232afd8a909934f974dda017a7954376de6a

SHA256
0737de4f747ee8260403c54b41b39125933680875bbe91f95d8522130489995c

SHA512
3c4c33c3b62d7101582b3af2a27443317d3158097c9e204f3fcfd2341eab7e45e479a034fbb451fff80e692751919ae43b07ad4aba4652ed545f225912f2aa1b

Download Submit
C:\ProgramData\OfficeVerif.exe

MD5
40cc80e562ea60f3e59a5fdadc1507da

SHA1
43a2232afd8a909934f974dda017a7954376de6a

SHA256
0737de4f747ee8260403c54b41b39125933680875bbe91f95d8522130489995c

SHA512
3c4c33c3b62d7101582b3af2a27443317d3158097c9e204f3fcfd2341eab7e45e479a034fbb451fff80e692751919ae43b07ad4aba4652ed545f225912f2aa1b

Download Submit
\Users\Admin\AppData\Local\Temp\nsiD921.tmp\System.dll

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
memory/3220-7-0x0000000000000000-mapping.dmp

Download
memory/3260-12-0x0000000000488EB4-mapping.dmp

Download
memory/3260-14-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/3260-15-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/3584-9-0x0000000000000000-mapping.dmp

Download
memory/4032-6-0x0000018D4EBE0000-0x0000018D4F217000-memory.dmp

Filesize
6.2MB

Download
memory/4032-5-0x00007FF8731B0000-0x00007FF8731C0000-memory.dmp

Filesize
64KB

Download
memory/4032-4-0x00007FF8731B0000-0x00007FF8731C0000-memory.dmp

Filesize
64KB

Download
memory/4032-2-0x00007FF8731B0000-0x00007FF8731C0000-memory.dmp

Filesize
64KB

Download
memory/4032-3-0x00007FF8731B0000-0x00007FF8731C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads