matanbuchus | 0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a

Analysis

Target

0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll
Size

522KB
MD5

aaf943c5a95b3dd813c441d3bdca0e5a
SHA1

529a1793f8019042952a379bbd91da51e02aa2b1
SHA256

0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a
SHA512

647ae31e6bbe7e8646c75d8d52a2c6e5f81eb9c815821fda164ba21d6754052f9c49a9048fac4ec976ba9d234599e0b9abdd6f278b422329a5f244bbcf570297

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

644 3512 WerFault.exe rundll32.exe

pid	pid_target	process	target process
644	3512	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 644 WerFault.exe
Token: SeBackupPrivilege 644 WerFault.exe
Token: SeDebugPrivilege 644 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3032 wrote to memory of 3512	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 3512	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 3512	3032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll,#1
2⤵
PID:3512

memory/3512-115-0x0000000000000000-mapping.dmp

Download
memory/3512-116-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3512-118-0x0000000004760000-0x000000000477E000-memory.dmp

Filesize
120KB

Download
memory/3512-117-0x0000000004760000-0x000000000477E000-memory.dmp

Filesize
120KB

Download
memory/3512-120-0x0000000004760000-0x000000000477E000-memory.dmp

Filesize
120KB

Download
memory/3512-119-0x0000000004720000-0x000000000473F000-memory.dmp

Filesize
124KB

Download