Analysis
-
max time kernel
130s -
max time network
130s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 06:12
Static task
static1
Behavioral task
behavioral1
Sample
NKP210102-NIT-SC2.exe
Resource
win7v20201028
General
-
Target
NKP210102-NIT-SC2.exe
-
Size
779KB
-
MD5
087dfca6f2b2c9825a49d4b986d7f539
-
SHA1
748e44b93cf2882248b2e27c728eb11018984bf4
-
SHA256
af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7
-
SHA512
25ab703c8261e1c36e4656b405b2aff6c8595bc26fe3b0f982e7249a90d6d6405d5f66ff8c28f8696d16c99a479718657dc669e0e4e5c2abe00e3ea03bac588d
Malware Config
Extracted
Protocol: smtp- Host:
mail.revistaeducar.com.ar - Port:
25 - Username:
smtp-1a2c5@revistaeducar.com.ar - Password:
somchai#3774
Extracted
matiex
Protocol: smtp- Host:
mail.revistaeducar.com.ar - Port:
25 - Username:
smtp-1a2c5@revistaeducar.com.ar - Password:
somchai#3774
Signatures
-
Matiex Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-9-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex behavioral1/memory/1704-11-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex behavioral1/memory/1704-10-0x000000000046DD1E-mapping.dmp family_matiex behavioral1/memory/1704-12-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 checkip.dyndns.org 10 freegeoip.app 11 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NKP210102-NIT-SC2.exedescription pid process target process PID 2024 set thread context of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegSvcs.exepid process 1704 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1704 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1704 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
NKP210102-NIT-SC2.exedescription pid process target process PID 2024 wrote to memory of 2000 2024 NKP210102-NIT-SC2.exe schtasks.exe PID 2024 wrote to memory of 2000 2024 NKP210102-NIT-SC2.exe schtasks.exe PID 2024 wrote to memory of 2000 2024 NKP210102-NIT-SC2.exe schtasks.exe PID 2024 wrote to memory of 2000 2024 NKP210102-NIT-SC2.exe schtasks.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe PID 2024 wrote to memory of 1704 2024 NKP210102-NIT-SC2.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NKP210102-NIT-SC2.exe"C:\Users\Admin\AppData\Local\Temp\NKP210102-NIT-SC2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kVTLnkXYUzFB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C01.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9C01.tmpMD5
6511e6497f3929b1233fb12ebc6ecf40
SHA1408a90b62f94a8eaada2dc4e3549d47218e7d911
SHA256c93290f75b70a15cae9c5faf96c7d0e47e69c087ce30541533556f2650056195
SHA512013843123ff08628974bc2e9a4bbcb938174c73370407b698aff3acf4c2e480ab439828bf19a0c2bc9674005da3bcf19b0c8e40fdfdfaa528b6fd89743dfee64
-
memory/1704-9-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-11-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-10-0x000000000046DD1E-mapping.dmp
-
memory/1704-12-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-13-0x0000000073500000-0x0000000073BEE000-memory.dmpFilesize
6.9MB
-
memory/2000-7-0x0000000000000000-mapping.dmp
-
memory/2024-2-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/2024-3-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/2024-5-0x0000000000310000-0x000000000031E000-memory.dmpFilesize
56KB
-
memory/2024-6-0x0000000005080000-0x0000000005141000-memory.dmpFilesize
772KB