matanbuchus | 0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a

Analysis

Target

0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll
Size

522KB
MD5

aaf943c5a95b3dd813c441d3bdca0e5a
SHA1

529a1793f8019042952a379bbd91da51e02aa2b1
SHA256

0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a
SHA512

647ae31e6bbe7e8646c75d8d52a2c6e5f81eb9c815821fda164ba21d6754052f9c49a9048fac4ec976ba9d234599e0b9abdd6f278b422329a5f244bbcf570297

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27
PID 1276 wrote to memory of 1556	1276	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll,#1
  2⤵
  PID:1556

memory/1556-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1556-56-0x00000000001F0000-0x0000000000276000-memory.dmp

Filesize
536KB

Download
memory/1556-57-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1556-59-0x0000000000300000-0x000000000031E000-memory.dmp

Filesize
120KB

Download
memory/1556-58-0x0000000000300000-0x000000000031E000-memory.dmp

Filesize
120KB

Download
memory/1556-60-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/1556-61-0x0000000000300000-0x000000000031E000-memory.dmp

Filesize
120KB

Download