Matanbuchus 3.0: Technical Analysis

Summary

Matanbuchus is a C++-based malicious downloader that has been distributed as a Malware‑as‑a‑Service (MaaS) offering since 2020. Version 3.0, observed in July 2025, introduces Protobuf-based serialization, ChaCha20 encryption, and multiple new anti-analysis techniques. The malware is composed of a downloader module that retrieves a primary backdoor module from its C2 server, then handles persistence, command execution, and delivery of follow-on payloads. It has been tied to ransomware incidents and to campaigns distributing the Rhadamanthys information stealer and NetSupport RAT.

Matanbuchus 3.0 Analysis

The analysis describes two components, a downloader and a main module, and walks through the initial infection chain using QuickAssist, a malicious MSI hosted on gpa-cro.com, and a side-loaded DLL posing as HRUpdate.exe. The downloader reaches out to mechiraz.com to obtain the main module, which then registers with the C2, creates a scheduled task named Update Tracker Task, and sets a per-host mutex. C2 traffic flows over HTTPS using encrypted Protobuf messages secured with ChaCha20 keys and nonces.

Mitigation

Defensive measures include blocking the malicious gpa-cro.com and mechiraz.com domains at the network edge, monitoring for creation of the Update Tracker Task and the associated HKCU registry key, and enforcing application whitelisting to stop untrusted MSI packages and side-loaded DLLs from executing. Security teams should detect characteristic ChaCha20-encrypted traffic and restrict the use of Windows utilities such as msiexec for unsigned or unverified files.

Response

When Matanbuchus activity is detected, isolate the impacted system, capture the scheduled task definition, registry entry, mutex value, and any retrieved payloads, and then remove the malicious binaries and tasks. Perform comprehensive endpoint forensics to uncover second-stage payloads and any exfiltrated data, followed by resetting exposed credentials and remediating affected Active Directory accounts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

1. User Execution (T1204) – The attacker persuades the user to open QuickAssist.
2. DLL Side‑Loading (T1574.001) – While QuickAssist runs, the attacker copies a malicious DLL (malicious.dll) into the same directory as HRUpdate.exe and then launches HRUpdate.exe, causing the malicious DLL to load.
3. Scheduled‑Task Creation (T1546.010) – The attacker uses msiexec.exe -z combined with a shell command (powershell -EncodedCommand …) to create a hidden scheduled task that runs the malicious payload.
4. Signed Binary Proxy Execution (T1218.002 / T1218.007) – The payload is launched via msiexec and optionally via WMI (wmic process call create …) to blend with legitimate admin actions.

Regression Test Script

# -------------------------------------------------
# Simulation Script – Matanbuchus Activity (TTPs)
# -------------------------------------------------
# 1. Deploy malicious DLL next to HRUpdate.exe
$malDllPath = "$env:ProgramFiles\HRUpdate\malicious.dll"
Copy-Item -Path ".\malicious.dll" -Destination $malDllPath -Force

# 2. Launch QuickAssist (legitimate)
Start-Process -FilePath "C:\Program Files\QuickAssist\QuickAssist.exe" -WindowStyle Hidden

# 3. Execute HRUpdate.exe to trigger DLL side‑loading
Start-Process -FilePath "C:\Program Files\HRUpdate\HRUpdate.exe" -ArgumentList "/silent" -Wait

# 4. Create a scheduled task using msiexec.exe -z
$taskName = "SysUpdate"
$taskCmd  = "powershell -NoProfile -WindowStyle Hidden -EncodedCommand " +
            ([Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Start-Process notepad.exe')))
$msiCmd = "msiexec.exe -z $taskName /quiet /qn /l*v `"$env:TEMP\msi.log`" /i $taskCmd"
Start-Process -FilePath "C:\Windows\System32\msiexec.exe" -ArgumentList $msiCmd -WindowStyle Hidden

# 5. (Optional) Execute the same payload via WMI to cover T1218.007
$wmiCmd = "cmd /c $taskCmd"
wmic process call create "$wmiCmd"
# -------------------------------------------------
# End of Simulation
# -------------------------------------------------

Cleanup Commands

# Terminate any lingering QuickAssist or HRUpdate processes
Get-Process -Name "QuickAssist","HRUpdate" -ErrorAction SilentlyContinue | Stop-Process -Force

# Remove the malicious DLL
Remove-Item -Path "$env:ProgramFiles\HRUpdate\malicious.dll" -Force -ErrorAction SilentlyContinue

# Delete the scheduled task
schtasks /Delete /TN "SysUpdate" /F

# Remove temporary msiexec log
Remove-Item -Path "$env:TEMP\msi.log" -Force -ErrorAction SilentlyContinue