matanbuchus | 8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88

Analysis

Target

8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88.dll
Size

522KB
MD5

d1f793800415a201822a8dc7597a96d7
SHA1

f6fb94b9d316d57f088d48892c3815345104aefc
SHA256

8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88
SHA512

2a2f0f127f7b7449789a373b6d06589f8948f48b8efcd8682b9eb94a1b15eebfe199d85179f39afd473f3edcb9616d4cf7dda926264b0b864dbf8978de6999f4

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3272 3204 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3272	3204	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3272 WerFault.exe
Token: SeBackupPrivilege 3272 WerFault.exe
Token: SeDebugPrivilege 3272 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1804 wrote to memory of 3204	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 3204	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 3204	1804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8da5082cd25674462962a5c3d23f2907e4502891a616f9506af017dea5a18f88.dll,#1
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3272

memory/3204-118-0x0000000000000000-mapping.dmp

Download
memory/3204-119-0x0000000005210000-0x000000000522E000-memory.dmp

Filesize
120KB

Download
memory/3204-120-0x0000000005210000-0x000000000522E000-memory.dmp

Filesize
120KB

Download
memory/3204-122-0x00000000049E0000-0x00000000049FF000-memory.dmp

Filesize
124KB

Download
memory/3204-121-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/3204-123-0x0000000005210000-0x000000000522E000-memory.dmp

Filesize
120KB

Download