Overview
overview
10Static
static
102022-06-16...ts.zip
windows7_x64
12022-06-16...ts.zip
windows10-2004_x64
12022-06-16...ke.txt
windows7_x64
12022-06-16...ke.txt
windows10-2004_x64
12022-06-16...LL.dll
windows7_x64
12022-06-16...LL.dll
windows10-2004_x64
12022-06-16...ff.bin
windows7_x64
32022-06-16...ff.bin
windows10-2004_x64
32022-06-16...bs.txt
windows7_x64
12022-06-16...bs.txt
windows10-2004_x64
12022-06-16...gv.bin
windows7_x64
32022-06-16...gv.bin
windows10-2004_x64
32022-06-16...us.txt
windows7_x64
12022-06-16...us.txt
windows10-2004_x64
12022-06-16...ry.bin
windows7_x64
32022-06-16...ry.bin
windows10-2004_x64
32022-06-16...LL.dll
windows7_x64
12022-06-16...LL.dll
windows10-2004_x64
12022-06-16...px.txt
windows7_x64
12022-06-16...px.txt
windows10-2004_x64
1SCAN-016063.html
windows7_x64
1SCAN-016063.html
windows10-2004_x64
1SCAN-01606...le.zip
windows7_x64
1SCAN-01606...le.zip
windows10-2004_x64
1SCAN-016063.pdf.msi
windows7_x64
10SCAN-016063.pdf.msi
windows10-2004_x64
10SCAN-016063.html
windows7_x64
1SCAN-016063.html
windows10-2004_x64
1SCAN-016063.pdf.msi
windows7_x64
10SCAN-016063.pdf.msi
windows10-2004_x64
10SCAN-026764.html
windows7_x64
1SCAN-026764.html
windows10-2004_x64
1Analysis
-
max time kernel
145s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 12:52
Static task
static1
Behavioral task
behavioral1
Sample
2022-06-16-Matanbuchus-and-Cobalt-Strike-malware-and-artifacts.zip
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
2022-06-16-Matanbuchus-and-Cobalt-Strike-malware-and-artifacts.zip
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
2022-06-16-IOCs-for-Matanbuchus-and-Cobalt-Strike.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral4
Sample
2022-06-16-IOCs-for-Matanbuchus-and-Cobalt-Strike.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral5
Sample
2022-06-16-Matanbuchus-DLL.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral6
Sample
2022-06-16-Matanbuchus-DLL.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral7
Sample
2022-06-16-extic.icu-empower-type.tiff.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral8
Sample
2022-06-16-extic.icu-empower-type.tiff.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral9
Sample
2022-06-16-notify.vbs.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral10
Sample
2022-06-16-notify.vbs.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral11
Sample
2022-06-16-reykh.icu-load-hunt.jpgv.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral12
Sample
2022-06-16-reykh.icu-load-hunt.jpgv.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral13
Sample
2022-06-16-scheduled-task-for-Matanbuchus.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral14
Sample
2022-06-16-scheduled-task-for-Matanbuchus.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral15
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral16
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral17
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral18
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-decoded-DLL.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral19
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx.txt
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral20
Sample
2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx.txt
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral21
Sample
SCAN-016063.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral22
Sample
SCAN-016063.html
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral23
Sample
SCAN-016063-from-html-file.zip
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral24
Sample
SCAN-016063-from-html-file.zip
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral25
Sample
SCAN-016063.pdf.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral26
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral27
Sample
SCAN-016063.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral28
Sample
SCAN-016063.html
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral29
Sample
SCAN-016063.pdf.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral30
Sample
SCAN-016063.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral31
Sample
SCAN-026764.html
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral32
Sample
SCAN-026764.html
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
2022-06-16-Matanbuchus-DLL.dll
-
Size
401KB
-
MD5
f354998cefb35626ac34c77ca2a6d808
-
SHA1
0357cb803c5999d26e97928e9519fa8cf106d9b3
-
SHA256
0bdf1060b85ad55e73393eb0b59c1d226e091da4f4dcce65dacba5e9a1fd76a7
-
SHA512
245cb6e20d82ddf669531e7f051f7541edca580f8683285d02d53376b9a8126f4fc16f67e39cf48194f96124cfcdc718f8219a3737db038271a3a8c10444fb3e
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1652 2044 rundll32.exe 27 PID 2044 wrote to memory of 1652 2044 rundll32.exe 27 PID 2044 wrote to memory of 1652 2044 rundll32.exe 27 PID 2044 wrote to memory of 1652 2044 rundll32.exe 27 PID 2044 wrote to memory of 1652 2044 rundll32.exe 27 PID 2044 wrote to memory of 1652 2044 rundll32.exe 27 PID 2044 wrote to memory of 1652 2044 rundll32.exe 27