matanbuchus | 490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c

Analysis

max time kernel
121s
max time network
121s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-12-2021 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll
Size

544KB
MD5

d1230ae077174b20767cc5375b13d25f
SHA1

52245cee97892bf43f0f63265c206008482b61d5
SHA256

490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c
SHA512

992f9e91ba6949b44fed32101cd3409da0ca75e1eaa6245c5b1fc627b0c9f0602e97f23b7e56e9c47e446a53a9e387ac3c8f91c0cf7807c80abd9705f55b0b59

Score

10^/10

matanbuchus loader

Malware Config

Extracted

Family

matanbuchus

https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml

https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3620 2664 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3620	2664	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe
3620	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3620 WerFault.exe
Token: SeBackupPrivilege 3620 WerFault.exe
Token: SeDebugPrivilege 3620 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3620	WerFault.exe
Token: SeBackupPrivilege	3620	WerFault.exe
Token: SeDebugPrivilege	3620	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2464 wrote to memory of 2664	2464	rundll32.exe	rundll32.exe
PID 2464 wrote to memory of 2664	2464	rundll32.exe	rundll32.exe
PID 2464 wrote to memory of 2664	2464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
2⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 688
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-115-0x0000000000000000-mapping.dmp

Download
memory/2664-117-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download
memory/2664-116-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download
memory/2664-118-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2664-119-0x00000000010D0000-0x00000000010EF000-memory.dmp

Filesize
124KB

Download
memory/2664-120-0x00000000011E0000-0x00000000011FE000-memory.dmp

Filesize
120KB

Download