Analysis
- max time kernel
160s - max time network
179s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
15/02/2022, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
7b9f1fd3135b90775a463bf0521d3269de106cfe8e35ec91506aacfe12347209.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7b9f1fd3135b90775a463bf0521d3269de106cfe8e35ec91506aacfe12347209.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 7b9f1fd3135b90775a463bf0521d3269de106cfe8e35ec91506aacfe12347209.exe
- Size 372KB
- Sample220215-m9sbcsfehl
- SHA256 7b9f1fd3135b90775a463bf0521d3269de106cfe8e35ec91506aacfe12347209
- MD5 b1790d0559ca13480bf5a1a6a215aceb
- SHA1 36f6c1946a1096d3c9857c39d8eb61ead55e045a
- SHA512 fad9ea952cc00c3864612708ff831f34c9170a343cac1f6e6f541ab4f4f39e019d348786ff7421092b9efa2ea3450a33c7595ec68b174fc2ffb39de356a5bd22
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
matanbuchus
C2
-
http://gw397iwauwsf.top/Plugin.triumphdrop
Signatures
- Matanbuchus
A loader sold as MaaS first seen in February 2021.
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 816 svchost.exe Token: SeCreatePagefilePrivilege 816 svchost.exe Token: SeShutdownPrivilege 816 svchost.exe Token: SeCreatePagefilePrivilege 816 svchost.exe Token: SeShutdownPrivilege 816 svchost.exe Token: SeCreatePagefilePrivilege 816 svchost.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe Token: SeRestorePrivilege 64 TiWorker.exe Token: SeSecurityPrivilege 64 TiWorker.exe Token: SeBackupPrivilege 64 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b9f1fd3135b90775a463bf0521d3269de106cfe8e35ec91506aacfe12347209.exe"C:\Users\Admin\AppData\Local\Temp\7b9f1fd3135b90775a463bf0521d3269de106cfe8e35ec91506aacfe12347209.exe"1⤵PID:4212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:816
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:64