rustybuer | c036d1c05516a8df5ea47b37cf51676e02f06ddc69532b600e3a9e1e50da3de2

General

Target

Private doc.docm
Size

3.4MB
MD5

00865fba20ef7d34ed136b9533401755
SHA1

49d83871e2fdf8ca5f05c7eb67a580943cb930ed
SHA256

c036d1c05516a8df5ea47b37cf51676e02f06ddc69532b600e3a9e1e50da3de2
SHA512

7c3507805b52164df804c3bd43520467773bb53a930de0a2ad8275a8747a3a11f4330e955b7b7f7b972a80ef0279cae3a77d4f71ab11adb3eac31c34f9bece80

Score

10^/10

rustybuer loader

Malware Config

Extracted

Family

rustybuer

C2

https://bankdocuments-api.com/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3100	816	cmd.exe	WINWORD.EXE

RustyBuer
RustyBuer is a new variant of Buer loader written in Rust.
loader rustybuer
Executes dropped EXE 2 IoCs

Processes:

OfficeConsultPlugin.exeOfficeConsultPlugin.exe

pid process

4032 OfficeConsultPlugin.exe
3832 OfficeConsultPlugin.exe
Loads dropped DLL 1 IoCs

Processes:

OfficeConsultPlugin.exe

pid process

4032 OfficeConsultPlugin.exe

pid	process
4032	OfficeConsultPlugin.exe
3832	OfficeConsultPlugin.exe

pid	process
4032	OfficeConsultPlugin.exe

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

OfficeConsultPlugin.exe

description	ioc	process
File opened (read-only)	\??\e:	OfficeConsultPlugin.exe
File opened (read-only)	\??\g:	OfficeConsultPlugin.exe
File opened (read-only)	\??\l:	OfficeConsultPlugin.exe
File opened (read-only)	\??\O:	OfficeConsultPlugin.exe
File opened (read-only)	\??\x:	OfficeConsultPlugin.exe
File opened (read-only)	\??\Z:	OfficeConsultPlugin.exe
File opened (read-only)	\??\B:	OfficeConsultPlugin.exe
File opened (read-only)	\??\I:	OfficeConsultPlugin.exe
File opened (read-only)	\??\N:	OfficeConsultPlugin.exe
File opened (read-only)	\??\p:	OfficeConsultPlugin.exe
File opened (read-only)	\??\y:	OfficeConsultPlugin.exe
File opened (read-only)	\??\V:	OfficeConsultPlugin.exe
File opened (read-only)	\??\A:	OfficeConsultPlugin.exe
File opened (read-only)	\??\D:	OfficeConsultPlugin.exe
File opened (read-only)	\??\m:	OfficeConsultPlugin.exe
File opened (read-only)	\??\Q:	OfficeConsultPlugin.exe
File opened (read-only)	\??\U:	OfficeConsultPlugin.exe
File opened (read-only)	\??\v:	OfficeConsultPlugin.exe
File opened (read-only)	\??\F:	OfficeConsultPlugin.exe
File opened (read-only)	\??\G:	OfficeConsultPlugin.exe
File opened (read-only)	\??\H:	OfficeConsultPlugin.exe
File opened (read-only)	\??\L:	OfficeConsultPlugin.exe
File opened (read-only)	\??\P:	OfficeConsultPlugin.exe
File opened (read-only)	\??\s:	OfficeConsultPlugin.exe
File opened (read-only)	\??\S:	OfficeConsultPlugin.exe
File opened (read-only)	\??\a:	OfficeConsultPlugin.exe
File opened (read-only)	\??\E:	OfficeConsultPlugin.exe
File opened (read-only)	\??\f:	OfficeConsultPlugin.exe
File opened (read-only)	\??\J:	OfficeConsultPlugin.exe
File opened (read-only)	\??\o:	OfficeConsultPlugin.exe
File opened (read-only)	\??\r:	OfficeConsultPlugin.exe
File opened (read-only)	\??\T:	OfficeConsultPlugin.exe
File opened (read-only)	\??\w:	OfficeConsultPlugin.exe
File opened (read-only)	\??\W:	OfficeConsultPlugin.exe
File opened (read-only)	\??\n:	OfficeConsultPlugin.exe
File opened (read-only)	\??\Y:	OfficeConsultPlugin.exe
File opened (read-only)	\??\u:	OfficeConsultPlugin.exe
File opened (read-only)	\??\X:	OfficeConsultPlugin.exe
File opened (read-only)	\??\h:	OfficeConsultPlugin.exe
File opened (read-only)	\??\i:	OfficeConsultPlugin.exe
File opened (read-only)	\??\j:	OfficeConsultPlugin.exe
File opened (read-only)	\??\K:	OfficeConsultPlugin.exe
File opened (read-only)	\??\M:	OfficeConsultPlugin.exe
File opened (read-only)	\??\q:	OfficeConsultPlugin.exe
File opened (read-only)	\??\z:	OfficeConsultPlugin.exe
File opened (read-only)	\??\b:	OfficeConsultPlugin.exe
File opened (read-only)	\??\k:	OfficeConsultPlugin.exe
File opened (read-only)	\??\R:	OfficeConsultPlugin.exe
File opened (read-only)	\??\t:	OfficeConsultPlugin.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

OfficeConsultPlugin.exe

description pid process target process

PID 4032 set thread context of 3832 4032 OfficeConsultPlugin.exe OfficeConsultPlugin.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4032 set thread context of 3832	4032	OfficeConsultPlugin.exe	OfficeConsultPlugin.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\ProgramData\OfficeConsultPlugin.exe	nsis_installer_1
C:\ProgramData\OfficeConsultPlugin.exe	nsis_installer_2
C:\ProgramData\OfficeConsultPlugin.exe	nsis_installer_1
C:\ProgramData\OfficeConsultPlugin.exe	nsis_installer_2
C:\ProgramData\OfficeConsultPlugin.exe	nsis_installer_1
C:\ProgramData\OfficeConsultPlugin.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

816 WINWORD.EXE
816 WINWORD.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

OfficeConsultPlugin.exe

pid process

4032 OfficeConsultPlugin.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

816 WINWORD.EXE
816 WINWORD.EXE
816 WINWORD.EXE
816 WINWORD.EXE
816 WINWORD.EXE
816 WINWORD.EXE
816 WINWORD.EXE

pid	process
816	WINWORD.EXE
816	WINWORD.EXE

pid	process
4032	OfficeConsultPlugin.exe

pid	process
816	WINWORD.EXE
816	WINWORD.EXE
816	WINWORD.EXE
816	WINWORD.EXE
816	WINWORD.EXE
816	WINWORD.EXE
816	WINWORD.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

WINWORD.EXEcmd.exeexplorer.exeOfficeConsultPlugin.exe

description	pid	process	target process
PID 816 wrote to memory of 3100	816	WINWORD.EXE	cmd.exe
PID 816 wrote to memory of 3100	816	WINWORD.EXE	cmd.exe
PID 3100 wrote to memory of 1188	3100	cmd.exe	explorer.exe
PID 3100 wrote to memory of 1188	3100	cmd.exe	explorer.exe
PID 3392 wrote to memory of 4032	3392	explorer.exe	OfficeConsultPlugin.exe
PID 3392 wrote to memory of 4032	3392	explorer.exe	OfficeConsultPlugin.exe
PID 3392 wrote to memory of 4032	3392	explorer.exe	OfficeConsultPlugin.exe
PID 4032 wrote to memory of 3832	4032	OfficeConsultPlugin.exe	OfficeConsultPlugin.exe
PID 4032 wrote to memory of 3832	4032	OfficeConsultPlugin.exe	OfficeConsultPlugin.exe
PID 4032 wrote to memory of 3832	4032	OfficeConsultPlugin.exe	OfficeConsultPlugin.exe
PID 4032 wrote to memory of 3832	4032	OfficeConsultPlugin.exe	OfficeConsultPlugin.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Private doc.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "explorer.exe /root,C:\ProgramData\OfficeConsultPlugin.exe", vbHide
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\explorer.exe
    explorer.exe /root,C:\ProgramData\OfficeConsultPlugin.exe, vbHide
    3⤵
    PID:1188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\ProgramData\OfficeConsultPlugin.exe
  "C:\ProgramData\OfficeConsultPlugin.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\ProgramData\OfficeConsultPlugin.exe
    "C:\ProgramData\OfficeConsultPlugin.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OfficeConsultPlugin.exe

MD5
fba1fd894b9201a11e866ba58c80ae61

SHA1
89236d9795f1e8db7d895d0e364dd4768ebc6410

SHA256
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a

SHA512
0d37b91123abb1ded40ae7604980dffa675dcacc1bf772b06e36a2e4c72488558511dd3f8df0fc47d9a6cc870eaef4a9e54a55b20a4432b5802cdeeba327470a

Download Submit
C:\ProgramData\OfficeConsultPlugin.exe

MD5
fba1fd894b9201a11e866ba58c80ae61

SHA1
89236d9795f1e8db7d895d0e364dd4768ebc6410

SHA256
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a

SHA512
0d37b91123abb1ded40ae7604980dffa675dcacc1bf772b06e36a2e4c72488558511dd3f8df0fc47d9a6cc870eaef4a9e54a55b20a4432b5802cdeeba327470a

Download Submit
C:\ProgramData\OfficeConsultPlugin.exe

MD5
fba1fd894b9201a11e866ba58c80ae61

SHA1
89236d9795f1e8db7d895d0e364dd4768ebc6410

SHA256
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a

SHA512
0d37b91123abb1ded40ae7604980dffa675dcacc1bf772b06e36a2e4c72488558511dd3f8df0fc47d9a6cc870eaef4a9e54a55b20a4432b5802cdeeba327470a

Download Submit
\Users\Admin\AppData\Local\Temp\nshD6FE.tmp\System.dll

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
memory/816-5-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmp

Filesize
64KB

Download
memory/816-6-0x00007FFB80F70000-0x00007FFB815A7000-memory.dmp

Filesize
6.2MB

Download
memory/816-2-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmp

Filesize
64KB

Download
memory/816-4-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmp

Filesize
64KB

Download
memory/816-3-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmp

Filesize
64KB

Download
memory/1188-8-0x0000000000000000-mapping.dmp

Download
memory/3100-7-0x0000000000000000-mapping.dmp

Download
memory/3832-13-0x0000000000488AD2-mapping.dmp

Download
memory/3832-15-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/3832-16-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/4032-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads