matanbuchus | 6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405 | Triage

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-06-2022 15:28

Sharing

Report Analysis Logs

General

Target

6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405.dll
Size

1.6MB
MD5

834efbd28c9bc41cb6e41dbfe5e75855
SHA1

d6b856cb860cceac628fc1bc54d5670b4e0fb7d7
SHA256

6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405
SHA512

35f08da981242e9978ea20e22a151ba0ee80b22b92cdf07053df437cbff1cd0311bd0666a9f33b14bfd55d412b495c1163151bfc7c6387dc31ca9cddf35e8383

Score

10^/10

matanbuchus loader

Malware Config

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 1772	3844	rundll32.exe	81
PID 3844 wrote to memory of 1772	3844	rundll32.exe	81
PID 3844 wrote to memory of 1772	3844	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c28c703f185aa4d626a1523b03c2893d6401e24b52a4081d2624cad9932d405.dll,#1
  2⤵
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-131-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download