matanbuchus | 890ac5a5052207139cbafcfe5bd61aeb0d56539020aeb4135a61233f0ee07446

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-01-2024 02:05

Target

693553ae717b96b77c270f853b47fac2.dll
Size

772KB
MD5

693553ae717b96b77c270f853b47fac2
SHA1

5573adbf55846fb873ecf490ac7300ddec4dda01
SHA256

890ac5a5052207139cbafcfe5bd61aeb0d56539020aeb4135a61233f0ee07446
SHA512

b5bbb1b1216007601d1db362edebf181c5607c4e88596d691f2448ac0ad07ca0de2126ff5977d9bd49a40b202e8eb8b59bf613659c48910e708be9843fb64532
SSDEEP

12288:gEIofc+w8/eAd9k7vfAcyNAgD3PkA3AX3w175AGX3My4xfXr5qnk7Nw6k2:gEIA/LdWsdNAgeXKpdcXNBhwj2

Score

10^/10

Family

matanbuchus

http://allupdateinstall.at/www/update/v11.0/appconfig.xml

http://deylyupdateinstallversionsoft.com/www/update/v11.0/appconfig.xml

http://bestinstallversion.com/www/update/v11.0/appconfig.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2296	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28
PID 2184 wrote to memory of 2296	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\693553ae717b96b77c270f853b47fac2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\693553ae717b96b77c270f853b47fac2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

memory/2296-0-0x00000000001C0000-0x0000000000298000-memory.dmp

Filesize
864KB

Download
memory/2296-1-0x00000000001C0000-0x0000000000298000-memory.dmp

Filesize
864KB

Download
memory/2296-3-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2296-5-0x00000000001C0000-0x0000000000298000-memory.dmp

Filesize
864KB

Download