matanbuchus | 0198e1a422da21797f0763ac6a3783046d960fa884640ff23f60349647433ec2

Analysis

Target

0198e1a422da21797f0763ac6a3783046d960fa884640ff23f60349647433ec2.dll
Size

525KB
MD5

8a2148caf20abf6cf9f5d14fe757ece7
SHA1

0ea0f741547e308c34ab1bfe6b16cba3c2315938
SHA256

0198e1a422da21797f0763ac6a3783046d960fa884640ff23f60349647433ec2
SHA512

7930146c5f4a3f14aee971d6504b0ddf74c003ed819e6f87842074ca11f034a7770c16e40f97cb2c428430b9ea5761197650508754d134b5c55dac5515413447

Score

10^/10

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15
PID 1756 wrote to memory of 1720	1756	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0198e1a422da21797f0763ac6a3783046d960fa884640ff23f60349647433ec2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0198e1a422da21797f0763ac6a3783046d960fa884640ff23f60349647433ec2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

memory/1720-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1720-56-0x0000000000280000-0x0000000000309000-memory.dmp

Filesize
548KB

Download
memory/1720-58-0x0000000000940000-0x0000000000960000-memory.dmp

Filesize
128KB

Download
memory/1720-57-0x0000000000940000-0x0000000000960000-memory.dmp

Filesize
128KB

Download
memory/1720-60-0x0000000000940000-0x0000000000960000-memory.dmp

Filesize
128KB

Download
memory/1720-59-0x00000000008B0000-0x00000000008CE000-memory.dmp

Filesize
120KB

Download