Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-06-2022 20:00

General

  • Target

    docs_06_30_2022.xlsb

  • Size

    58KB

  • MD5

    f391b6abfa46df66449a0446f80d4168

  • SHA1

    ef875d0ed399227b6a549c150f2d7f881096f303

  • SHA256

    1fc6bed3f1f9a03513cff88ce3d523852565812a75874800add07b4a2efe870b

  • SHA512

    6ac260767d721f91aaa5e3e0f04e8f2270572c4db3fa7942153776d93bc12c79a69adb7a7da1eea1fff8d4ed7c9c001a3eb675035bbafb0fdaba2dd5b82ddcdd

Score
10/10

Malware Config

Signatures

  • Matanbuchus

    A loader sold as MaaS first seen in February 2021.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\docs_06_30_2022.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:432
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4756
    • \??\c:\windows\system32\regsvr32.exe
      c:\windows\system32\regsvr32.exe -n -i:"Update Installation" "C:\Users\Admin\AppData\Local\AdobeStockClient\ado.lic"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Windows\SysWOW64\regsvr32.exe
        -n -i:"Update Installation" "C:\Users\Admin\AppData\Local\AdobeStockClient\ado.lic"
        3⤵
        • Loads dropped DLL
        PID:3152

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\AdobeStockClient\ado.lic

    Filesize

    2.5MB

    MD5

    64a2807bc1385ee99c892012ed0a62bf

    SHA1

    1d21c43b582ca6ad77714c05976fe5827f028bd0

    SHA256

    e66c2a09074fa94390262c8b925988e7d9a085edcc97cad79e2ccc9c0e862567

    SHA512

    78352c8643206849726ff7240d9a80faedc76f9586943dd8cdb649ff62af658a849258783fec50157b5f7118a0442ab538a475886d44a2993b2aa7be1b5b46a1

  • C:\Users\Admin\AppData\Local\AdobeStockClient\ado.lic

    Filesize

    2.5MB

    MD5

    64a2807bc1385ee99c892012ed0a62bf

    SHA1

    1d21c43b582ca6ad77714c05976fe5827f028bd0

    SHA256

    e66c2a09074fa94390262c8b925988e7d9a085edcc97cad79e2ccc9c0e862567

    SHA512

    78352c8643206849726ff7240d9a80faedc76f9586943dd8cdb649ff62af658a849258783fec50157b5f7118a0442ab538a475886d44a2993b2aa7be1b5b46a1

  • memory/432-133-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-145-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-134-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-135-0x00007FFAA2CD0000-0x00007FFAA2CE0000-memory.dmp

    Filesize

    64KB

  • memory/432-136-0x00007FFAA2CD0000-0x00007FFAA2CE0000-memory.dmp

    Filesize

    64KB

  • memory/432-137-0x0000024686EB0000-0x0000024686EB4000-memory.dmp

    Filesize

    16KB

  • memory/432-148-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-131-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-147-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-132-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-130-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/432-146-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmp

    Filesize

    64KB

  • memory/3152-142-0x00000000026A0000-0x0000000002867000-memory.dmp

    Filesize

    1.8MB

  • memory/3152-143-0x0000000002C40000-0x0000000002CBB000-memory.dmp

    Filesize

    492KB