matanbuchus | 49284eb85d58dbe31d8da683a85a0a09eae81d438f2ec23524ef775018e31aa3

Analysis

max time kernel
112s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 18:10

Target

f87f4fdefab5ae7d4c852b2e4c125b5a_JaffaCakes118.dll
Size

570KB
MD5

f87f4fdefab5ae7d4c852b2e4c125b5a
SHA1

4c38b775024c4b7f20a082a6ade3c583f046285f
SHA256

49284eb85d58dbe31d8da683a85a0a09eae81d438f2ec23524ef775018e31aa3
SHA512

5f0d6439607666a493c40cc00536808c5d726b25b72b9272771438d3d94b4ab41a9b4a96e45a37d55788eec8c17ebb63caa35075422bdfe1d8a3697fea0785ec
SSDEEP

12288:TQJkUW20CjBwC0PSDdSLxQgOUtdByJxcU5InnykeyCgw:kJnf0CiC0Cd+6vwQL

Score

10^/10

Family

matanbuchus

http://45.93.201.209/update/31359/8108.svg

http://45.93.201.209/update/85943897/xpth8.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2624 208 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2624	208	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3248 wrote to memory of 208	3248	regsvr32.exe	regsvr32.exe
PID 3248 wrote to memory of 208	3248	regsvr32.exe	regsvr32.exe
PID 3248 wrote to memory of 208	3248	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f87f4fdefab5ae7d4c852b2e4c125b5a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f87f4fdefab5ae7d4c852b2e4c125b5a_JaffaCakes118.dll
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 1104
    3⤵
    - Program crash
    PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 208 -ip 208
1⤵
PID:5108

memory/208-0-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/208-1-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/208-2-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/208-3-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/208-4-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/208-12-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/208-15-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download