Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-12-2021 07:35
Static task
static1
Behavioral task
behavioral1
Sample
52f13f6be6220affb4acc182f974dabe.exe
Resource
win7-en-20211208
General
-
Target
52f13f6be6220affb4acc182f974dabe.exe
-
Size
841KB
-
MD5
52f13f6be6220affb4acc182f974dabe
-
SHA1
275d2e03ece179e04787fd2fd4174589a4794d2d
-
SHA256
2568251040acb82859e2944aac69d01701c95d89d3d28e30a02b5445a0946ca1
-
SHA512
13ee949087eaf6253b2f2395c2e00bf44e303cd334971219faf87e2bfd83371df51d543d20f834cf5dbaacfc81928e3c2590501de8a816bfbfb40866413af330
Malware Config
Extracted
matiex
https://api.telegram.org/bot1915791669:AAHbaTcWupO_GTP0Ize2y4KAhHdYK5bPczo/sendMessage?chat_id=1114717555
Extracted
asyncrat
0.5.7B
Default
52.178.132.52:6606
52.178.132.52:7707
52.178.132.52:8808
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
true
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Matiex Main Payload 5 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\BIBILZ.exe family_matiex C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe family_matiex C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe family_matiex behavioral1/memory/1112-65-0x0000000001290000-0x0000000001306000-memory.dmp family_matiex behavioral1/memory/1112-66-0x0000000001290000-0x0000000001306000-memory.dmp family_matiex -
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-72-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2040-75-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2040-73-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2040-76-0x000000000040C71E-mapping.dmp asyncrat behavioral1/memory/2040-77-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2040-78-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
BIBILZ.exepid process 1112 BIBILZ.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52f13f6be6220affb4acc182f974dabe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52f13f6be6220affb4acc182f974dabe.exe -
Drops startup file 1 IoCs
Processes:
BIBILZ.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%nmoufstr%.url BIBILZ.exe -
Loads dropped DLL 1 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exepid process 1684 52f13f6be6220affb4acc182f974dabe.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
BIBILZ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 checkip.dyndns.org 12 freegeoip.app 13 freegeoip.app -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 52f13f6be6220affb4acc182f974dabe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 52f13f6be6220affb4acc182f974dabe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription pid process target process PID 1684 set thread context of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
BIBILZ.exepid process 1112 BIBILZ.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exeBIBILZ.exevbc.exedescription pid process Token: SeDebugPrivilege 1684 52f13f6be6220affb4acc182f974dabe.exe Token: SeDebugPrivilege 1112 BIBILZ.exe Token: SeDebugPrivilege 2040 vbc.exe Token: SeDebugPrivilege 2040 vbc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exeBIBILZ.exedescription pid process target process PID 1684 wrote to memory of 1112 1684 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 1684 wrote to memory of 1112 1684 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 1684 wrote to memory of 1112 1684 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 1684 wrote to memory of 1112 1684 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 1684 wrote to memory of 1032 1684 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 1684 wrote to memory of 1032 1684 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 1684 wrote to memory of 1032 1684 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 1684 wrote to memory of 1032 1684 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1684 wrote to memory of 2040 1684 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 1112 wrote to memory of 1136 1112 BIBILZ.exe netsh.exe PID 1112 wrote to memory of 1136 1112 BIBILZ.exe netsh.exe PID 1112 wrote to memory of 1136 1112 BIBILZ.exe netsh.exe PID 1112 wrote to memory of 1136 1112 BIBILZ.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
BIBILZ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe -
outlook_win_path 1 IoCs
Processes:
BIBILZ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52f13f6be6220affb4acc182f974dabe.exe"C:\Users\Admin\AppData\Local\Temp\52f13f6be6220affb4acc182f974dabe.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe"C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cOSEdHWJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exeMD5
3909dfbc501304e780b91e47bae11c6f
SHA19ecfeb5103ab0d066678e2d537ae6a8a996f7306
SHA2566584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1
SHA512591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e
-
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exeMD5
3909dfbc501304e780b91e47bae11c6f
SHA19ecfeb5103ab0d066678e2d537ae6a8a996f7306
SHA2566584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1
SHA512591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e
-
C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmpMD5
7c52a86ea15666e9df488c8c73f7f67b
SHA10f870c3b373fd023352f4fe3dfc977895c8226db
SHA2566676e9c4548f869c58dce7f7378eae4a71069ae40dee2f43f2de8c3aa497dfe7
SHA512eaf3f7a07d134d89b0701594060055942636892a9ddc736e9ee6e5fb3e2367f8bc68cdc4fc2f7c23ce76de43b5e4546ecb76888405e181498ab1508f5a474429
-
\Users\Admin\AppData\Local\Temp\BIBILZ.exeMD5
3909dfbc501304e780b91e47bae11c6f
SHA19ecfeb5103ab0d066678e2d537ae6a8a996f7306
SHA2566584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1
SHA512591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e
-
memory/1032-68-0x0000000000000000-mapping.dmp
-
memory/1112-74-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/1112-66-0x0000000001290000-0x0000000001306000-memory.dmpFilesize
472KB
-
memory/1112-65-0x0000000001290000-0x0000000001306000-memory.dmpFilesize
472KB
-
memory/1112-62-0x0000000000000000-mapping.dmp
-
memory/1136-81-0x0000000000000000-mapping.dmp
-
memory/1684-59-0x0000000005B10000-0x0000000005B76000-memory.dmpFilesize
408KB
-
memory/1684-55-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1684-53-0x0000000001080000-0x0000000001158000-memory.dmpFilesize
864KB
-
memory/1684-58-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1684-57-0x00000000005B0000-0x00000000005C4000-memory.dmpFilesize
80KB
-
memory/1684-56-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/1684-54-0x0000000001080000-0x0000000001158000-memory.dmpFilesize
864KB
-
memory/1684-60-0x0000000000770000-0x0000000000782000-memory.dmpFilesize
72KB
-
memory/2040-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-73-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-76-0x000000000040C71E-mapping.dmp
-
memory/2040-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-80-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/2040-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB