matanbuchus | 490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c

Analysis

Target

490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll
Size

544KB
MD5

d1230ae077174b20767cc5375b13d25f
SHA1

52245cee97892bf43f0f63265c206008482b61d5
SHA256

490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c
SHA512

992f9e91ba6949b44fed32101cd3409da0ca75e1eaa6245c5b1fc627b0c9f0602e97f23b7e56e9c47e446a53a9e387ac3c8f91c0cf7807c80abd9705f55b0b59

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 1632	740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
  2⤵
  PID:1632

memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x00000000007B0000-0x000000000083C000-memory.dmp

Filesize
560KB

Download
memory/1632-58-0x0000000000710000-0x000000000072E000-memory.dmp

Filesize
120KB

Download
memory/1632-57-0x0000000000710000-0x000000000072E000-memory.dmp

Filesize
120KB

Download
memory/1632-60-0x0000000000390000-0x00000000003AF000-memory.dmp

Filesize
124KB

Download
memory/1632-59-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1632-61-0x0000000000710000-0x000000000072E000-memory.dmp

Filesize
120KB

Download