Edit tour

Windows Analysis Report
QUclYxO7PA.dll

Overview

General Information

Sample Name:	QUclYxO7PA.dll
Analysis ID:	591183
MD5:	d1230ae077174b20767cc5375b13d25f
SHA1:	52245cee97892bf43f0f63265c206008482b61d5
SHA256:	490bcee7c0b9607d834fd8b3e5d01613d062fcf48be043e6f5f60c5077b55e3c
Infos:

Detection

CryptOne Matanbuchus

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Matanbuchus

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Antivirus / Scanner detection for submitted sample

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Sigma detected: Suspicious Call by Ordinal

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Uses 32bit PE files

Yara signature match

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to record screenshots

Uses the system / local time for branch decision (may execute only at specific dates)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Contains functionality to read the PEB

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4816 cmdline: loaddll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 6356 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5892 cmdline: rundll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 2088 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 720 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Matanbuchus

{"C2 list": ["https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml", "https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml", "https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml", "https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml", "https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000000.364773490.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000004.00000000.364059244.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000001.00000002.435533780.0000000002780000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000004.00000000.364094356.00000000010B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000001.00000002.435793901.00000000027A0000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
00000001.00000002.435793901.00000000027A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000001.00000002.435324092.0000000002760000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000004.00000002.380933753.00000000010D0000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
00000004.00000002.380933753.00000000010D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000004.00000002.380779649.00000000010B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000004.00000000.364817732.00000000010D0000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
00000004.00000000.364817732.00000000010D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000004.00000000.364126169.00000000010D0000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
00000004.00000000.364126169.00000000010D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000004.00000000.364799522.00000000010B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
00000004.00000002.380714826.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.10d0000.3.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
4.2.rundll32.exe.10d0000.3.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
1.2.loaddll32.exe.27a0000.2.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
1.2.loaddll32.exe.27a0000.2.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.2.rundll32.exe.1070184.1.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
1.2.loaddll32.exe.2760184.0.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10b0000.6.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
1.2.loaddll32.exe.27a0000.2.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10d0000.3.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
4.0.rundll32.exe.10d0000.3.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.2.rundll32.exe.10b0000.2.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10d0000.3.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
1.2.loaddll32.exe.2780000.1.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10d0000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1b494:$s2: #??;8qdd 0x1b524:$s2: \x1D\x01\x01\x05\x06OZZ 0x1b654:$s2: wkkol%00 0x1b6d4:$s2: 1--)*cvv 0x1b7a4:$s2: vjjnm$11
4.2.rundll32.exe.10d0000.3.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10d0000.7.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.1070184.5.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10b0000.2.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.10d0000.7.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
4.0.rundll32.exe.1070184.1.raw.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Call by Ordinal

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6356, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\QUclYxO7PA.dll",#1, ProcessId: 5892

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.0.rundll32.exe.10d0000.7.raw.unpack

Malware Configuration Extractor: Matanbuchus {"C2 list": ["https://belialw869367.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml", "https://belialr878539.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml", "https://beliale232634.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml", "https://belialp632298.at/b0868b6b-7f2c-4ac6-ba54-ba9b13744d17/clinton45.xml", "https://belialq449663.at/f5126584-3f68-4e0c-868a-dcb2455f8146/Y2xpbnRvbjQ1.xml"]}

Multi AV Scanner detection for submitted file

Source: QUclYxO7PA.dll	Virustotal: Detection: 64%	Perma Link
Source: QUclYxO7PA.dll	Metadefender: Detection: 41%	Perma Link
Source: QUclYxO7PA.dll	ReversingLabs: Detection: 82%

Antivirus / Scanner detection for submitted sample

Source: QUclYxO7PA.dll

Avira: detected

Source: QUclYxO7PA.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: QUclYxO7PA.dll

Static PE information: certificate valid

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_027AD51A FindFirstFileExW,		1_2_027AD51A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00885408 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcp

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
QUclYxO7PA.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Matanbuchus

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUclYxO7PA.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Matanbuchus

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Windows Analysis Report
QUclYxO7PA.dll