matanbuchus | 8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88

Analysis

Target

8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88.dll
Size

522KB
MD5

d1f793800415a201822a8dc7597a96d7
SHA1

f6fb94b9d316d57f088d48892c3815345104aefc
SHA256

8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88
SHA512

2a2f0f127f7b7449789a373b6d06589f8948f48b8efcd8682b9eb94a1b15eebfe199d85179f39afd473f3edcb9616d4cf7dda926264b0b864dbf8978de6999f4

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 964	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88.dll,#1
  2⤵
  PID:964

memory/964-54-0x0000000000000000-mapping.dmp

Download
memory/964-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x0000000000240000-0x00000000002C6000-memory.dmp

Filesize
536KB

Download
memory/964-57-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/964-59-0x00000000003B0000-0x00000000003CE000-memory.dmp

Filesize
120KB

Download
memory/964-58-0x00000000003B0000-0x00000000003CE000-memory.dmp

Filesize
120KB

Download
memory/964-61-0x00000000003B0000-0x00000000003CE000-memory.dmp

Filesize
120KB

Download
memory/964-60-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download