Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
11-11-2021 16:32
Static task
static1
Behavioral task
behavioral1
Sample
SsSuaeML7312gbk.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
SsSuaeML7312gbk.exe
Resource
win10-en-20211104
General
-
Target
SsSuaeML7312gbk.exe
-
Size
683KB
-
MD5
b228b9a2a36d06fd91d942e464ef16bd
-
SHA1
8a974471c6336b046f08d17d8ba4c31d7d151b9c
-
SHA256
108f33743a4ef5a5008a666449da79ba8505820db73e7e5098cb90c2cdd0ee66
-
SHA512
cb14152f1284087fd4206a27eea79cc4d2f568f3fbc1e1962cf64d1e5b97a4c8d4cce1925fe910dea421f401e8d5c07cf0c632405ff2e26f72873662f9a3ad09
Malware Config
Extracted
matiex
https://api.telegram.org/bot1962824736:AAECUA300NkJ2NuTf0cKgva_k26j1y0NNHk/sendMessage?chat_id=457082756
Signatures
-
Matiex Main Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-70-0x0000000000400000-0x000000000048C000-memory.dmp family_matiex behavioral1/memory/1556-71-0x0000000000400000-0x000000000048C000-memory.dmp family_matiex behavioral1/memory/1556-73-0x000000000046E0DE-mapping.dmp family_matiex behavioral1/memory/1556-72-0x0000000000400000-0x000000000048C000-memory.dmp family_matiex behavioral1/memory/1556-74-0x0000000000400000-0x000000000048C000-memory.dmp family_matiex -
Drops startup file 1 IoCs
Processes:
SsSuaeML7312gbk.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regeditt.url SsSuaeML7312gbk.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
SsSuaeML7312gbk.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SsSuaeML7312gbk.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SsSuaeML7312gbk.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SsSuaeML7312gbk.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 9 freegeoip.app 10 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SsSuaeML7312gbk.exedescription pid process target process PID 764 set thread context of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
SsSuaeML7312gbk.exepowershell.exepowershell.exeSsSuaeML7312gbk.exepid process 764 SsSuaeML7312gbk.exe 764 SsSuaeML7312gbk.exe 764 SsSuaeML7312gbk.exe 764 SsSuaeML7312gbk.exe 764 SsSuaeML7312gbk.exe 764 SsSuaeML7312gbk.exe 764 SsSuaeML7312gbk.exe 844 powershell.exe 336 powershell.exe 1556 SsSuaeML7312gbk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SsSuaeML7312gbk.exeSsSuaeML7312gbk.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 764 SsSuaeML7312gbk.exe Token: SeDebugPrivilege 1556 SsSuaeML7312gbk.exe Token: SeDebugPrivilege 336 powershell.exe Token: SeDebugPrivilege 844 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
SsSuaeML7312gbk.exedescription pid process target process PID 764 wrote to memory of 336 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 336 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 336 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 336 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 844 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 844 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 844 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 844 764 SsSuaeML7312gbk.exe powershell.exe PID 764 wrote to memory of 808 764 SsSuaeML7312gbk.exe schtasks.exe PID 764 wrote to memory of 808 764 SsSuaeML7312gbk.exe schtasks.exe PID 764 wrote to memory of 808 764 SsSuaeML7312gbk.exe schtasks.exe PID 764 wrote to memory of 808 764 SsSuaeML7312gbk.exe schtasks.exe PID 764 wrote to memory of 1036 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1036 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1036 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1036 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 988 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 988 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 988 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 988 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe PID 764 wrote to memory of 1556 764 SsSuaeML7312gbk.exe SsSuaeML7312gbk.exe -
outlook_office_path 1 IoCs
Processes:
SsSuaeML7312gbk.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SsSuaeML7312gbk.exe -
outlook_win_path 1 IoCs
Processes:
SsSuaeML7312gbk.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SsSuaeML7312gbk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gEvJkZJcG.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gEvJkZJcG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCAB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"2⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBCAB.tmpMD5
d0b1e9eaddf01be72f5c72781f91eb02
SHA19a2f058d72af1d2ef9f6f6038e31cf82e1bce9e6
SHA25629682446f07bd2a69b497390af50dbf2eef5cfd8bbdeb3dd632bfdaa5a8cdb2a
SHA5127de186ebc1ef2223cd5ee17a34c73b09d7f734b6041e895ed5aff9269e823cb3b431700ff038e3416bda24b9fa163658802d214583074243b2bb58eaa5337cb6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
f9733aa4b70dc9d0f9a21f6fdc3eeb06
SHA1a726e5fbb3cad1b2c2e6f03a20cc84e6a80f4283
SHA2566067d7e16b8d2fe8af0b69510417fc1ed499e550f269a3b9f2b2b7ce92bed654
SHA512711947b4f4d94c438131ddf4448cbc2529e47fbd5b7588bf6ee3bc6a4741d4abd549567c4fc30808745f1d25ebd4ce1f7e42b86cd56c2e2278905cec697b5acf
-
memory/336-82-0x00000000025B2000-0x00000000025B4000-memory.dmpFilesize
8KB
-
memory/336-61-0x0000000000000000-mapping.dmp
-
memory/336-76-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/336-79-0x00000000025B1000-0x00000000025B2000-memory.dmpFilesize
4KB
-
memory/764-57-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/764-58-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/764-59-0x00000000005B0000-0x00000000005B7000-memory.dmpFilesize
28KB
-
memory/764-60-0x00000000055B0000-0x0000000005708000-memory.dmpFilesize
1.3MB
-
memory/764-55-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/808-64-0x0000000000000000-mapping.dmp
-
memory/844-81-0x0000000002302000-0x0000000002304000-memory.dmpFilesize
8KB
-
memory/844-78-0x0000000002301000-0x0000000002302000-memory.dmpFilesize
4KB
-
memory/844-63-0x0000000000000000-mapping.dmp
-
memory/844-77-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/1556-71-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1556-73-0x000000000046E0DE-mapping.dmp
-
memory/1556-72-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1556-74-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1556-70-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1556-69-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1556-80-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/1556-68-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB