Overview
overview
10Static
static
102022-06-16...ts.zip
windows7_x64
12022-06-16...ts.zip
windows10-2004_x64
12022-06-16...ke.txt
windows7_x64
12022-06-16...ke.txt
windows10-2004_x64
12022-06-16...LL.dll
windows7_x64
12022-06-16...LL.dll
windows10-2004_x64
12022-06-16...ff.bin
windows7_x64
32022-06-16...ff.bin
windows10-2004_x64
32022-06-16...bs.txt
windows7_x64
12022-06-16...bs.txt
windows10-2004_x64
12022-06-16...gv.bin
windows7_x64
32022-06-16...gv.bin
windows10-2004_x64
32022-06-16...us.txt
windows7_x64
12022-06-16...us.txt
windows10-2004_x64
12022-06-16...ry.bin
windows7_x64
32022-06-16...ry.bin
windows10-2004_x64
32022-06-16...LL.dll
windows7_x64
12022-06-16...LL.dll
windows10-2004_x64
12022-06-16...px.txt
windows7_x64
12022-06-16...px.txt
windows10-2004_x64
1SCAN-016063.html
windows7_x64
1SCAN-016063.html
windows10-2004_x64
1SCAN-01606...le.zip
windows7_x64
1SCAN-01606...le.zip
windows10-2004_x64
1SCAN-016063.pdf.msi
windows7_x64
10SCAN-016063.pdf.msi
windows10-2004_x64
10SCAN-016063.html
windows7_x64
1SCAN-016063.html
windows10-2004_x64
1SCAN-016063.pdf.msi
windows7_x64
10SCAN-016063.pdf.msi
windows10-2004_x64
10SCAN-026764.html
windows7_x64
1SCAN-026764.html
windows10-2004_x64
1Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 12:52
Static task
static1
Behavioral task
behavioral1
Sample
2022-06-16-Matanbuchus-and-Cobalt-Strike-malware-and-artifacts.zip
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
2022-06-16-Matanbuchus-and-Cobalt-Strike-malware-and-artifacts.zip
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
2022-06-16-IOCs-for-Matanbuchus-and-Cobalt-Strike.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral4
Sample
2022-06-16-IOCs-for-Matanbuchus-and-Cobalt-Strike.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral5
Sample
2022-06-16-Matanbuchus-DLL.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral6
Sample
2022-06-16-Matanbuchus-DLL.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral7
Sample
2022-06-16-extic.icu-empower-type.tiff.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral8
Sample
2022-06-16-extic.icu-empower-type.tiff.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral9
Sample
2022-06-16-notify.vbs.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral10
Sample
2022-06-16-notify.vbs.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral11
Sample
2022-06-16-reykh.icu-load-hunt.jpgv.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral12
Sample
2022-06-16-reykh.icu-load-hunt.jpgv.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral13
Sample
2022-06-16-scheduled-task-for-Matanbuchus.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral14
Sample
2022-06-16-scheduled-task-for-Matanbuchus.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral15
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral16
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral17
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral18
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral19
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral20
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral21
Sample
SCAN-016063.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral22
Sample
SCAN-016063.html
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral23
Sample
SCAN-016063-from-html-file.zip
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral24
Sample
SCAN-016063-from-html-file.zip
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral25
Sample
SCAN-016063.pdf.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral26
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral27
Sample
SCAN-016063.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral28
Sample
SCAN-016063.html
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral29
Sample
SCAN-016063.pdf.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral30
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral31
Sample
SCAN-026764.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral32
Sample
SCAN-026764.html
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
-
Size
591KB
-
MD5
8fc15b030254c0d49f18d06c696d6986
-
SHA1
75f62f4d419b921bc081b5e8387665ac3cffd0d7
-
SHA256
bd68ecd681b844232f050c21c1ea914590351ef64e889d8ef37ea63bd9e2a2ec
-
SHA512
9b84ef2bddde8a493b1a9bec16fc01e8651cfa1ee08ebda326a15390b18fe8e0a40c5f8a2e36bbbd4f5848b7a3c04b4bbb955ca0b5dd04ee73991667d528838f
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2024 2040 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll2⤵PID:2024
-