Analysis
-
max time kernel
154s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-12-2021 15:06
Static task
static1
Behavioral task
behavioral1
Sample
2fe0d9dfd0fbaa96190944e7476165e9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2fe0d9dfd0fbaa96190944e7476165e9.exe
Resource
win10-en-20211208
General
-
Target
2fe0d9dfd0fbaa96190944e7476165e9.exe
-
Size
491KB
-
MD5
2fe0d9dfd0fbaa96190944e7476165e9
-
SHA1
4d19923e1648170f22388b60d5b2eee85e894136
-
SHA256
5a973c144d49d4ca870852219ed8de091cd22359160c82f00c1c5868ab0b124f
-
SHA512
d8c21aa9aca37bf20a3785c8ae675756b51061da9864950cc6ed2c942619e975802415940d94592c1de1ab6c13cee0fe82702ed547343620c7ce03b8c7fd9a2e
Malware Config
Extracted
Protocol: smtp- Host:
mail.salujaford.in - Port:
587 - Username:
[email protected] - Password:
saluja@#$chd
Extracted
matiex
Protocol: smtp- Host:
mail.salujaford.in - Port:
587 - Username:
[email protected] - Password:
saluja@#$chd
Signatures
-
Matiex Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1480-126-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral2/memory/1480-127-0x00000000004709CE-mapping.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2fe0d9dfd0fbaa96190944e7476165e9.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2fe0d9dfd0fbaa96190944e7476165e9.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2fe0d9dfd0fbaa96190944e7476165e9.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 checkip.dyndns.org 31 freegeoip.app 32 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exedescription pid process target process PID 3068 set thread context of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exe2fe0d9dfd0fbaa96190944e7476165e9.exepid process 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exe2fe0d9dfd0fbaa96190944e7476165e9.exedescription pid process Token: SeDebugPrivilege 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe Token: SeDebugPrivilege 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exe2fe0d9dfd0fbaa96190944e7476165e9.exedescription pid process target process PID 3068 wrote to memory of 3444 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe schtasks.exe PID 3068 wrote to memory of 3444 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe schtasks.exe PID 3068 wrote to memory of 3444 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe schtasks.exe PID 3068 wrote to memory of 1504 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1504 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1504 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 3068 wrote to memory of 1480 3068 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe PID 1480 wrote to memory of 3332 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe netsh.exe PID 1480 wrote to memory of 3332 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe netsh.exe PID 1480 wrote to memory of 3332 1480 2fe0d9dfd0fbaa96190944e7476165e9.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2fe0d9dfd0fbaa96190944e7476165e9.exe -
outlook_win_path 1 IoCs
Processes:
2fe0d9dfd0fbaa96190944e7476165e9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2fe0d9dfd0fbaa96190944e7476165e9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe"C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogCLil" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A8B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2fe0d9dfd0fbaa96190944e7476165e9.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmp7A8B.tmpMD5
1575fefb8c89a45a15f225dd80216dd9
SHA12f263564571ab702c34bce164435910053258817
SHA256afa910e156f0cc76efff3e10b986bb6bed27fe52431407e93604197700fff930
SHA512ebfc430419a91e2f72d6ac2088497b282cbcfd907aa1b4f95731e881f5d5ab91fc54bf1c6057d557a41a22a603c3653d44ee1f04a4c24df0e427d099d17d7c08
-
memory/1480-136-0x0000000007370000-0x0000000007371000-memory.dmpFilesize
4KB
-
memory/1480-133-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/1480-132-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/1480-127-0x00000000004709CE-mapping.dmp
-
memory/1480-126-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/3068-120-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/3068-123-0x00000000092B0000-0x00000000092B1000-memory.dmpFilesize
4KB
-
memory/3068-122-0x0000000009160000-0x000000000920C000-memory.dmpFilesize
688KB
-
memory/3068-121-0x00000000059F0000-0x0000000005A06000-memory.dmpFilesize
88KB
-
memory/3068-115-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/3068-119-0x00000000058F0000-0x0000000005DEE000-memory.dmpFilesize
5.0MB
-
memory/3068-118-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/3068-117-0x0000000005DF0000-0x0000000005DF1000-memory.dmpFilesize
4KB
-
memory/3332-135-0x0000000000000000-mapping.dmp
-
memory/3444-124-0x0000000000000000-mapping.dmp