matanbuchus | 8140ac01ec377af7788eddd79d665d5000b34e7d064499b96c9d540582b28913

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-en-20211208
submitted
14/12/2021, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yukoste3.ocx.dll
Size 522KB
Sample211214-we54eahbgj
SHA256 8140ac01ec377af7788eddd79d665d5000b34e7d064499b96c9d540582b28913
MD5 67d5dfcde8225a0cdf760d833ca44387
SHA1 9db7b3f5c7cff58d8a06f2f4cc82d9f7339f49e1
SHA512 1436c7b1b3168c93d185d86ed375ce8cd45a77c3135a27f68cb8b0aa7cf06a5ba7e05c688d2602d3bba2e73f811c13ab222f37d5fd4df4ad78561d35048e3fb8
MD5 SHA1 SHA512

Score

10^/10

matanbuchus loader

Malware Config

Extracted

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml
https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml
https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml
https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml
https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1768	960	rundll32.exe	27
PID 960 wrote to memory of 1768	960	rundll32.exe	27
PID 960 wrote to memory of 1768	960	rundll32.exe	27
PID 960 wrote to memory of 1768	960	rundll32.exe	27
PID 960 wrote to memory of 1768	960	rundll32.exe	27
PID 960 wrote to memory of 1768	960	rundll32.exe	27
PID 960 wrote to memory of 1768	960	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Yukoste3.ocx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Yukoste3.ocx.dll,#1
  2⤵
  PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Download

memory/1768-58-0x00000000004C0000-0x00000000004DE000-memory.dmp

Download

memory/1768-57-0x00000000004C0000-0x00000000004DE000-memory.dmp

Download

memory/1768-60-0x0000000000480000-0x000000000049F000-memory.dmp

Download

memory/1768-59-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1768-61-0x00000000004C0000-0x00000000004DE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads