Analysis
- max time kernel
121s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
17/11/2021, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
delta.ocx.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
delta.ocx.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target delta.ocx.dll
- Size 863KB
- Sample211117-bt375sdchk
- SHA256 aca6a42ef77fb9e13c8a77caad356b10b7f8114fa89de06acda9ab4e379a69f9
- MD5 a4d17faab32f86aa4546964dc1b317d8
- SHA1 6ef08c458a784bb2d5f41485285628ec37bf8b5b
- SHA512 e706f2daaeffa7a6bb006f7dd3c2bd6835a2e5ba55c7c9c6df5522156205ca4407fba1bcfc34df5de8434fb94b861fd60c6a50a9659859947a9ce423eaf232a7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
matanbuchus
C2
-
https://checkingsoftwareupdate.at/d8b8d14f-6842-46ec-b254-e92ffe990498/b32f9ccc
-
https://checkingupdatesoftware.at/d8b8d14f-6842-46ec-b254-e92ffe990498/b32f9ccc
-
https://softwareupdatechecking.at/d8b8d14f-6842-46ec-b254-e92ffe990498/4ad4e44f
-
https://softwarecheckingupdate.at/d8b8d14f-6842-46ec-b254-e92ffe990498/4ad4e44f
-
http://193.56.146.65/d8b8d14f-6842-46ec-b254-e92ffe990498/4ad4e44f
Signatures
- Matanbuchus
A loader sold as MaaS first seen in February 2021.
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2812 regsvr32.exe 2812 regsvr32.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe 2812 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2812 2616 regsvr32.exe 68 PID 2616 wrote to memory of 2812 2616 regsvr32.exe 68 PID 2616 wrote to memory of 2812 2616 regsvr32.exe 68
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\delta.ocx.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\delta.ocx.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2812
-