Analysis
-
max time kernel
112s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
07-12-2021 12:24
Static task
static1
Behavioral task
behavioral1
Sample
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Resource
win10-en-20211014
General
-
Target
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
-
Size
391KB
-
MD5
cff383a9c4716e6ce935e3b4132cef34
-
SHA1
95fb309753bdb273b8da6cfef6bd7af012d7d11f
-
SHA256
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c
-
SHA512
2dd9e08b8539b0bb27bd4a295accb8c48fc22ca34798df23058ee4bc86249b79efecf2b65cd30f71ddb3bd2bb068038163e4302b69bed7160f905897f9c5432d
Malware Config
Extracted
matiex
https://api.telegram.org/bot1769394961:AAF5BB35akL859CwVaXypIqpVsGWlaKvi7A/sendMessage?chat_id=1735544933
Signatures
-
Matiex Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2760-116-0x0000000000400000-0x0000000000484000-memory.dmp family_matiex behavioral1/memory/2760-117-0x000000000040188B-mapping.dmp family_matiex behavioral1/memory/2760-118-0x0000000000400000-0x0000000000484000-memory.dmp family_matiex behavioral1/memory/2760-119-0x00000000024B0000-0x000000000251F000-memory.dmp family_matiex -
Loads dropped DLL 1 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exepid process 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 freegeoip.app 19 freegeoip.app 16 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exedescription pid process target process PID 3044 set thread context of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exepid process 2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exedescription pid process Token: SeDebugPrivilege 2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exedescription pid process target process PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 3044 wrote to memory of 2760 3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe PID 2760 wrote to memory of 3648 2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe netsh.exe PID 2760 wrote to memory of 3648 2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe netsh.exe PID 2760 wrote to memory of 3648 2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe -
outlook_win_path 1 IoCs
Processes:
32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe"C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe"C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdCB31.tmp\rdhfmntmn.dllMD5
f8dcfcb741cfb789c8ac705cb7f69d81
SHA1bc0b5eea603016766c1e4d03ed8a9c758fb01652
SHA25610d18893a9d787122213566203de198c54274f8c63825065812378d364d3620a
SHA5125bc9a735e1dddbee74ac3cee43ecf4f469b2108966b2f914e474c7fa3205498900f2cb761f10eae45cfa9fa20bee500e223a8633f210914de23a0af6b385118d
-
memory/2760-124-0x0000000004B13000-0x0000000004B14000-memory.dmpFilesize
4KB
-
memory/2760-125-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/2760-118-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2760-119-0x00000000024B0000-0x000000000251F000-memory.dmpFilesize
444KB
-
memory/2760-121-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/2760-123-0x0000000004B12000-0x0000000004B13000-memory.dmpFilesize
4KB
-
memory/2760-117-0x000000000040188B-mapping.dmp
-
memory/2760-116-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2760-122-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/2760-126-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/2760-127-0x0000000004B14000-0x0000000004B15000-memory.dmpFilesize
4KB
-
memory/2760-131-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/2760-129-0x00000000060B0000-0x00000000060B1000-memory.dmpFilesize
4KB
-
memory/2760-130-0x0000000005F10000-0x0000000005F11000-memory.dmpFilesize
4KB
-
memory/3648-128-0x0000000000000000-mapping.dmp