matanbuchus | 0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a

Analysis

Target

0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll
Size

522KB
MD5

aaf943c5a95b3dd813c441d3bdca0e5a
SHA1

529a1793f8019042952a379bbd91da51e02aa2b1
SHA256

0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a
SHA512

647ae31e6bbe7e8646c75d8d52a2c6e5f81eb9c815821fda164ba21d6754052f9c49a9048fac4ec976ba9d234599e0b9abdd6f278b422329a5f244bbcf570297

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Program crash 1 IoCs

pid	pid_target	Process	procid_target
644	3512	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3512	3032	rundll32.exe	69
PID 3032 wrote to memory of 3512	3032	rundll32.exe	69
PID 3032 wrote to memory of 3512	3032	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0634f6c10ac079514d4db0ec04d842c48448538f3f636963d1ef17111bedc72a.dll,#1
  2⤵
  PID:3512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:644

memory/3512-116-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3512-118-0x0000000004760000-0x000000000477E000-memory.dmp

Filesize
120KB

Download
memory/3512-117-0x0000000004760000-0x000000000477E000-memory.dmp

Filesize
120KB

Download
memory/3512-120-0x0000000004760000-0x000000000477E000-memory.dmp

Filesize
120KB

Download
memory/3512-119-0x0000000004720000-0x000000000473F000-memory.dmp

Filesize
124KB

Download