matanbuchus | 6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405 | Triage

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
17-06-2022 15:28

Sharing

Report Analysis Logs

General

Target

6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405.dll
Size

1.6MB
MD5

834efbd28c9bc41cb6e41dbfe5e75855
SHA1

d6b856cb860cceac628fc1bc54d5670b4e0fb7d7
SHA256

6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405
SHA512

35f08da981242e9978ea20e22a151ba0ee80b22b92cdf07053df437cbff1cd0311bd0666a9f33b14bfd55d412b495c1163151bfc7c6387dc31ca9cddf35e8383

Score

10^/10

matanbuchus loader

Malware Config

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26
PID 2040 wrote to memory of 1956	2040	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405.dll,#1
  2⤵
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download