Analysis

  • max time kernel
    119s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    11-11-2021 16:38

General

  • Target

    SsSuaeML7312gbk.exe

  • Size

    683KB

  • MD5

    b228b9a2a36d06fd91d942e464ef16bd

  • SHA1

    8a974471c6336b046f08d17d8ba4c31d7d151b9c

  • SHA256

    108f33743a4ef5a5008a666449da79ba8505820db73e7e5098cb90c2cdd0ee66

  • SHA512

    cb14152f1284087fd4206a27eea79cc4d2f568f3fbc1e1962cf64d1e5b97a4c8d4cce1925fe910dea421f401e8d5c07cf0c632405ff2e26f72873662f9a3ad09

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1962824736:AAECUA300NkJ2NuTf0cKgva_k26j1y0NNHk/sendMessage?chat_id=457082756

Signatures

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

  • Matiex Main Payload 6 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe
    "C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gEvJkZJcG.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:988
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gEvJkZJcG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B78.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1108
    • C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe
      "C:\Users\Admin\AppData\Local\Temp\SsSuaeML7312gbk.exe"
      2⤵
      • Drops startup file
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1364

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp5B78.tmp

    MD5

    59898da2f4d520c141831a6ee3565209

    SHA1

    ea467ff3b443df08860d771f37e9168c3b7a2449

    SHA256

    30120ff43e8734eefdbdc3831c04c5f13fe514a0cc8102b4efd830e7338c46f6

    SHA512

    109ea77142c6a4f22fa02be1f776db0d100f1ad70da6c6ce6ad231350d42f6d7bec1b5fbf8bef4eeebfcb7482485d2027e44901604aec395922f781864281f1a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    MD5

    ea8e462739c5a08f82b1e1cc7ebffb6d

    SHA1

    3de837e2470360bbf05c0052e47d677a216e2b1b

    SHA256

    2c6ab9b033431327effb703776574a3ad05a153ee2ade413f2bd9154e77fa106

    SHA512

    0bb0e265cec0cf2d345d01a8992cdf22136ccf1aff16fcfa50dc3387892c6eef95dc9139159807344daeb33e87db8f5d297a4488990d9d9bd85f4eb7c705ccaa

  • memory/588-57-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

    Filesize

    4KB

  • memory/588-58-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/588-59-0x0000000005330000-0x0000000005488000-memory.dmp

    Filesize

    1.3MB

  • memory/588-55-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

    Filesize

    4KB

  • memory/988-78-0x0000000002480000-0x00000000030CA000-memory.dmp

    Filesize

    12.3MB

  • memory/988-62-0x0000000000000000-mapping.dmp

  • memory/988-76-0x0000000002480000-0x00000000030CA000-memory.dmp

    Filesize

    12.3MB

  • memory/988-80-0x0000000002480000-0x00000000030CA000-memory.dmp

    Filesize

    12.3MB

  • memory/1108-63-0x0000000000000000-mapping.dmp

  • memory/1364-68-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/1364-69-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/1364-70-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/1364-71-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/1364-72-0x000000000046E0DE-mapping.dmp

  • memory/1364-73-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/1364-67-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/1364-81-0x0000000002200000-0x0000000002201000-memory.dmp

    Filesize

    4KB

  • memory/1720-79-0x0000000002342000-0x0000000002344000-memory.dmp

    Filesize

    8KB

  • memory/1720-60-0x0000000000000000-mapping.dmp

  • memory/1720-77-0x0000000002341000-0x0000000002342000-memory.dmp

    Filesize

    4KB

  • memory/1720-61-0x0000000075461000-0x0000000075463000-memory.dmp

    Filesize

    8KB

  • memory/1720-75-0x0000000002340000-0x0000000002341000-memory.dmp

    Filesize

    4KB