Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-12-2021 07:35
Static task
static1
Behavioral task
behavioral1
Sample
52f13f6be6220affb4acc182f974dabe.exe
Resource
win7-en-20211208
General
-
Target
52f13f6be6220affb4acc182f974dabe.exe
-
Size
841KB
-
MD5
52f13f6be6220affb4acc182f974dabe
-
SHA1
275d2e03ece179e04787fd2fd4174589a4794d2d
-
SHA256
2568251040acb82859e2944aac69d01701c95d89d3d28e30a02b5445a0946ca1
-
SHA512
13ee949087eaf6253b2f2395c2e00bf44e303cd334971219faf87e2bfd83371df51d543d20f834cf5dbaacfc81928e3c2590501de8a816bfbfb40866413af330
Malware Config
Extracted
matiex
https://api.telegram.org/bot1915791669:AAHbaTcWupO_GTP0Ize2y4KAhHdYK5bPczo/sendMessage?chat_id=1114717555
Extracted
asyncrat
0.5.7B
Default
52.178.132.52:6606
52.178.132.52:7707
52.178.132.52:8808
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
true
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Matiex Main Payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe family_matiex C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe family_matiex behavioral2/memory/804-131-0x0000000000180000-0x00000000001F6000-memory.dmp family_matiex behavioral2/memory/804-132-0x0000000000180000-0x00000000001F6000-memory.dmp family_matiex behavioral2/memory/804-145-0x0000000004AB0000-0x0000000004FAE000-memory.dmp family_matiex -
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/912-138-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/912-139-0x000000000040C71E-mapping.dmp asyncrat behavioral2/memory/912-143-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/912-144-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
BIBILZ.exepid process 804 BIBILZ.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52f13f6be6220affb4acc182f974dabe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52f13f6be6220affb4acc182f974dabe.exe -
Drops startup file 1 IoCs
Processes:
BIBILZ.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%nmoufstr%.url BIBILZ.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
BIBILZ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 checkip.dyndns.org 32 freegeoip.app 33 freegeoip.app -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 52f13f6be6220affb4acc182f974dabe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 52f13f6be6220affb4acc182f974dabe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription pid process target process PID 2440 set thread context of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1000 804 WerFault.exe BIBILZ.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exeBIBILZ.exevbc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2440 52f13f6be6220affb4acc182f974dabe.exe Token: SeDebugPrivilege 804 BIBILZ.exe Token: SeDebugPrivilege 912 vbc.exe Token: SeDebugPrivilege 912 vbc.exe Token: SeRestorePrivilege 1000 WerFault.exe Token: SeBackupPrivilege 1000 WerFault.exe Token: SeDebugPrivilege 1000 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
52f13f6be6220affb4acc182f974dabe.exedescription pid process target process PID 2440 wrote to memory of 804 2440 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 2440 wrote to memory of 804 2440 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 2440 wrote to memory of 804 2440 52f13f6be6220affb4acc182f974dabe.exe BIBILZ.exe PID 2440 wrote to memory of 2452 2440 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 2440 wrote to memory of 2452 2440 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 2440 wrote to memory of 2452 2440 52f13f6be6220affb4acc182f974dabe.exe schtasks.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe PID 2440 wrote to memory of 912 2440 52f13f6be6220affb4acc182f974dabe.exe vbc.exe -
outlook_office_path 1 IoCs
Processes:
BIBILZ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe -
outlook_win_path 1 IoCs
Processes:
BIBILZ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 BIBILZ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52f13f6be6220affb4acc182f974dabe.exe"C:\Users\Admin\AppData\Local\Temp\52f13f6be6220affb4acc182f974dabe.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe"C:\Users\Admin\AppData\Local\Temp\BIBILZ.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 20963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cOSEdHWJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp144F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exeMD5
3909dfbc501304e780b91e47bae11c6f
SHA19ecfeb5103ab0d066678e2d537ae6a8a996f7306
SHA2566584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1
SHA512591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e
-
C:\Users\Admin\AppData\Local\Temp\BIBILZ.exeMD5
3909dfbc501304e780b91e47bae11c6f
SHA19ecfeb5103ab0d066678e2d537ae6a8a996f7306
SHA2566584bc68270df457d3430776e5d50531a2431f891a6716ed2c9641568de0dcf1
SHA512591d425d741a50d94dbfb85520db202abca81a1546728e06d757529cb3625aefe8b9c4556afcc4fdebb608c2784d4da160b8b20e19215189ef284f846e02ac1e
-
C:\Users\Admin\AppData\Local\Temp\tmp144F.tmpMD5
9a8ebf4c76f53af25d7478545fdf24a6
SHA1ce116183563ea8191f44a763b495d71d0b46f40b
SHA25658ca13a005a8cf982683a7f6e0839368cbfe792accc98a6631630afc90f4cf6f
SHA51268e45f9a3e1af200232b8ac398950e0e0fd61da70e6b0e4e26de3286615af009f76398be5e1d6a96fd8d3f2b3f2fb6d2d566cdf50739769572b54fb9a0618400
-
memory/804-128-0x0000000000000000-mapping.dmp
-
memory/804-145-0x0000000004AB0000-0x0000000004FAE000-memory.dmpFilesize
5.0MB
-
memory/804-136-0x0000000004B50000-0x0000000004BB6000-memory.dmpFilesize
408KB
-
memory/804-135-0x0000000004FB0000-0x00000000054AE000-memory.dmpFilesize
5.0MB
-
memory/804-134-0x0000000004A10000-0x0000000004AAC000-memory.dmpFilesize
624KB
-
memory/804-132-0x0000000000180000-0x00000000001F6000-memory.dmpFilesize
472KB
-
memory/804-131-0x0000000000180000-0x00000000001F6000-memory.dmpFilesize
472KB
-
memory/912-139-0x000000000040C71E-mapping.dmp
-
memory/912-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-147-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/912-146-0x00000000096E0000-0x00000000096E1000-memory.dmpFilesize
4KB
-
memory/912-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/912-142-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/912-141-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/912-140-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/2440-122-0x0000000004E20000-0x0000000004E76000-memory.dmpFilesize
344KB
-
memory/2440-121-0x0000000004B90000-0x0000000004B9A000-memory.dmpFilesize
40KB
-
memory/2440-118-0x0000000005060000-0x000000000555E000-memory.dmpFilesize
5.0MB
-
memory/2440-117-0x0000000004AB0000-0x0000000004B4C000-memory.dmpFilesize
624KB
-
memory/2440-120-0x0000000004B60000-0x000000000505E000-memory.dmpFilesize
5.0MB
-
memory/2440-115-0x00000000000C0000-0x0000000000198000-memory.dmpFilesize
864KB
-
memory/2440-127-0x000000000DC10000-0x000000000DC76000-memory.dmpFilesize
408KB
-
memory/2440-119-0x0000000004C00000-0x0000000004C92000-memory.dmpFilesize
584KB
-
memory/2440-126-0x000000000AB60000-0x000000000AB72000-memory.dmpFilesize
72KB
-
memory/2440-123-0x0000000005020000-0x0000000005034000-memory.dmpFilesize
80KB
-
memory/2440-124-0x000000007E120000-0x000000007E121000-memory.dmpFilesize
4KB
-
memory/2440-116-0x00000000000C0000-0x0000000000198000-memory.dmpFilesize
864KB
-
memory/2440-125-0x00000000083B0000-0x0000000008416000-memory.dmpFilesize
408KB
-
memory/2452-133-0x0000000000000000-mapping.dmp