Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-01-2021 10:23
Static task
static1
Behavioral task
behavioral1
Sample
a9bfd74205eaae0c0a3b4c5844f689e6.exe
Resource
win7v20201028
General
-
Target
a9bfd74205eaae0c0a3b4c5844f689e6.exe
-
Size
972KB
-
MD5
a9bfd74205eaae0c0a3b4c5844f689e6
-
SHA1
26a4db56a5c263be29df916729bb98762a15c818
-
SHA256
109bcfbd83db3f1cd25ebb84bff09634dbd32ba6142c9091dea6298df5c57541
-
SHA512
007daaa815973fd15bf8f78ec35a6fcc62e041ea3bcf2c659839c355e506240bbed6404d16dfc5653a98ee5f7fe8d49be39dbd083b3ed6b5986b064713199eab
Malware Config
Extracted
matiex
Protocol: smtp- Host:
mail.zavidovici.ba - Port:
587 - Username:
opcina.zavidovici@zavidovici.ba - Password:
12Opc21!
Signatures
-
Matiex Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/440-12-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/440-13-0x000000000047036E-mapping.dmp family_matiex behavioral1/memory/440-14-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/440-15-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 freegeoip.app 4 checkip.dyndns.org 9 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a9bfd74205eaae0c0a3b4c5844f689e6.exedescription pid process target process PID 1584 set thread context of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a9bfd74205eaae0c0a3b4c5844f689e6.exepid process 440 a9bfd74205eaae0c0a3b4c5844f689e6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a9bfd74205eaae0c0a3b4c5844f689e6.exedescription pid process Token: SeDebugPrivilege 440 a9bfd74205eaae0c0a3b4c5844f689e6.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
a9bfd74205eaae0c0a3b4c5844f689e6.exedescription pid process target process PID 1584 wrote to memory of 1648 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe schtasks.exe PID 1584 wrote to memory of 1648 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe schtasks.exe PID 1584 wrote to memory of 1648 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe schtasks.exe PID 1584 wrote to memory of 1648 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe schtasks.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe PID 1584 wrote to memory of 440 1584 a9bfd74205eaae0c0a3b4c5844f689e6.exe a9bfd74205eaae0c0a3b4c5844f689e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9bfd74205eaae0c0a3b4c5844f689e6.exe"C:\Users\Admin\AppData\Local\Temp\a9bfd74205eaae0c0a3b4c5844f689e6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yPPNqrw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD865.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a9bfd74205eaae0c0a3b4c5844f689e6.exe"C:\Users\Admin\AppData\Local\Temp\a9bfd74205eaae0c0a3b4c5844f689e6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD865.tmpMD5
15c33f47265782296a2abfe4acd29a0e
SHA15bf8b8e34495001f44eae79b082b537ed7eff35a
SHA256247a5157abe69bb822823e82b791a2f60dc0a07b727475012b03b6e4ca6839c1
SHA5125133802b305580a3dd9803b7662fbef2568a39031408ff05ce16ce3e692d862f2fe57c40131a6d9bb95d915cb5271c70ae089ff37f89cf77ce4a0b77c12ac3c9
-
memory/440-16-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/440-15-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/440-14-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/440-13-0x000000000047036E-mapping.dmp
-
memory/440-12-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1584-6-0x0000000005370000-0x00000000053E4000-memory.dmpFilesize
464KB
-
memory/1584-9-0x0000000005620000-0x00000000056BB000-memory.dmpFilesize
620KB
-
memory/1584-7-0x0000000000560000-0x0000000000568000-memory.dmpFilesize
32KB
-
memory/1584-2-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1584-5-0x0000000000210000-0x0000000000222000-memory.dmpFilesize
72KB
-
memory/1584-3-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/1648-10-0x0000000000000000-mapping.dmp