matanbuchus | 490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c

Analysis

Target

490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll
Size

544KB
MD5

d1230ae077174b20767cc5375b13d25f
SHA1

52245cee97892bf43f0f63265c206008482b61d5
SHA256

490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c
SHA512

992f9e91ba6949b44fed32101cd3409da0ca75e1eaa6245c5b1fc627b0c9f0602e97f23b7e56e9c47e446a53a9e387ac3c8f91c0cf7807c80abd9705f55b0b59

Score

10^/10

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3620 2664 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3620	2664	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3620 WerFault.exe
Token: SeBackupPrivilege 3620 WerFault.exe
Token: SeDebugPrivilege 3620 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2464 wrote to memory of 2664	2464	rundll32.exe	rundll32.exe
PID 2464 wrote to memory of 2664	2464	rundll32.exe	rundll32.exe
PID 2464 wrote to memory of 2664	2464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3620

memory/2664-115-0x0000000000000000-mapping.dmp

Download
memory/2664-117-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download
memory/2664-116-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download
memory/2664-118-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2664-119-0x00000000010D0000-0x00000000010EF000-memory.dmp

Filesize
124KB

Download
memory/2664-120-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download