Analysis
-
max time kernel
124s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-01-2021 17:52
Static task
static1
Behavioral task
behavioral1
Sample
Mj1eX5GWJxDRnuk.exe
Resource
win7v20201028
General
-
Target
Mj1eX5GWJxDRnuk.exe
-
Size
801KB
-
MD5
0a15abc755513fa5540383224e716007
-
SHA1
977b99a636046d643c056f241db30dd07c92edf5
-
SHA256
7cea033f51a991529c382fa2e8f87b84c4d096610dc5d191b005e5db6bbd7581
-
SHA512
9a564caafecde53867d1b7e7af97ec2690fdb5dbf744be436e8126c2dd0973c5c5e818ac6d300fe89f399df2e07850ceadc489d4356e7521aee115ac02d4944e
Malware Config
Extracted
matiex
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
sales01@seedwellresources.xyz - Password:
MARYolanmauluogwo@ever
Signatures
-
Matiex Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/440-9-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/440-10-0x000000000047095E-mapping.dmp family_matiex behavioral1/memory/440-12-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/440-11-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 freegeoip.app 10 freegeoip.app 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Mj1eX5GWJxDRnuk.exedescription pid process target process PID 1580 set thread context of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Mj1eX5GWJxDRnuk.exeMj1eX5GWJxDRnuk.exepid process 1580 Mj1eX5GWJxDRnuk.exe 440 Mj1eX5GWJxDRnuk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Mj1eX5GWJxDRnuk.exeMj1eX5GWJxDRnuk.exedescription pid process Token: SeDebugPrivilege 1580 Mj1eX5GWJxDRnuk.exe Token: SeDebugPrivilege 440 Mj1eX5GWJxDRnuk.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Mj1eX5GWJxDRnuk.exedescription pid process target process PID 1580 wrote to memory of 1408 1580 Mj1eX5GWJxDRnuk.exe schtasks.exe PID 1580 wrote to memory of 1408 1580 Mj1eX5GWJxDRnuk.exe schtasks.exe PID 1580 wrote to memory of 1408 1580 Mj1eX5GWJxDRnuk.exe schtasks.exe PID 1580 wrote to memory of 1408 1580 Mj1eX5GWJxDRnuk.exe schtasks.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe PID 1580 wrote to memory of 440 1580 Mj1eX5GWJxDRnuk.exe Mj1eX5GWJxDRnuk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mj1eX5GWJxDRnuk.exe"C:\Users\Admin\AppData\Local\Temp\Mj1eX5GWJxDRnuk.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kIJjFFH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F54.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Mj1eX5GWJxDRnuk.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8F54.tmpMD5
f7d82e81d211030529238690888dddc1
SHA1fce84d3e73aa91ea773f578eddb879da1bb06d39
SHA256c2ba97e77e439c956dfe030fd547cbd8c8de290535d066544866b1def86b930b
SHA5123fce62aadb7f15f1b28db3020a391757c177e1f6f346bff39efa72b3ad4254144255298263d45793a837166506ea537c674755ba9beb72fe133dfd31d53d00dc
-
memory/440-9-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/440-10-0x000000000047095E-mapping.dmp
-
memory/440-12-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/440-11-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/440-13-0x0000000073790000-0x0000000073E7E000-memory.dmpFilesize
6.9MB
-
memory/1408-7-0x0000000000000000-mapping.dmp
-
memory/1580-2-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1580-3-0x00000000012B0000-0x00000000012B1000-memory.dmpFilesize
4KB
-
memory/1580-5-0x00000000002D0000-0x00000000002DE000-memory.dmpFilesize
56KB
-
memory/1580-6-0x00000000055E0000-0x00000000056BA000-memory.dmpFilesize
872KB