matanbuchus | 490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c

Analysis

Target
490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll
Size 544KB
Sample211221-ltyb1achf7
SHA256 490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c
MD5 d1230ae077174b20767cc5375b13d25f
SHA1 52245cee97892bf43f0f63265c206008482b61d5
SHA512 992f9e91ba6949b44fed32101cd3409da0ca75e1eaa6245c5b1fc627b0c9f0602e97f23b7e56e9c47e446a53a9e387ac3c8f91c0cf7807c80abd9705f55b0b59
MD5 SHA1 SHA512

Score

10^/10

Family

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3620	2664	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2664	2464	rundll32.exe	69
PID 2464 wrote to memory of 2664	2464	rundll32.exe	69
PID 2464 wrote to memory of 2664	2464	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c.dll,#1
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3620

memory/2664-117-0x00000000011E0000-0x00000000011FE000-memory.dmp

Download

memory/2664-116-0x00000000011E0000-0x00000000011FE000-memory.dmp

Download

memory/2664-118-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/2664-119-0x00000000010D0000-0x00000000010EF000-memory.dmp

Download

memory/2664-120-0x00000000011E0000-0x00000000011FE000-memory.dmp

Download