Analysis
-
max time kernel
47s -
max time network
15s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
04-01-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
Order Inquiry.pdf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Order Inquiry.pdf.exe
Resource
win10-en-20211208
Errors
General
-
Target
Order Inquiry.pdf.exe
-
Size
444KB
-
MD5
d646a7fbfc045a2ca121353d752272fc
-
SHA1
39a2ec43451de6ea144b4b6788d5e465cde5faba
-
SHA256
8f0386a64599a9566543216e7a10713d7b40a3e58d01ca65b33eda5375baa57f
-
SHA512
fce5195dc1a6a5e78650d9ce7bbe68d9f3d108641f35d25db7a213bffe308c0d9176549085fa152351221a9f5abe1f3656cf1520af17880c4d45db8d192642c7
Malware Config
Extracted
matiex
https://api.telegram.org/bot2138776011:AAFUEthpbAgvwobq6WX1JcxgCq52Fx3vD1I/sendMessage?chat_id=2105782844
Signatures
-
Matiex Main Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1184-55-0x0000000000DA0000-0x0000000000E16000-memory.dmp family_matiex behavioral1/memory/1184-56-0x0000000000DA0000-0x0000000000E16000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Order Inquiry.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1824 1184 WerFault.exe Order Inquiry.pdf.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1824 WerFault.exe 1824 WerFault.exe 1824 WerFault.exe 1824 WerFault.exe 1824 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order Inquiry.pdf.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1184 Order Inquiry.pdf.exe Token: SeDebugPrivilege 1824 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Order Inquiry.pdf.exedescription pid process target process PID 1184 wrote to memory of 1824 1184 Order Inquiry.pdf.exe WerFault.exe PID 1184 wrote to memory of 1824 1184 Order Inquiry.pdf.exe WerFault.exe PID 1184 wrote to memory of 1824 1184 Order Inquiry.pdf.exe WerFault.exe PID 1184 wrote to memory of 1824 1184 Order Inquiry.pdf.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
Order Inquiry.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe -
outlook_win_path 1 IoCs
Processes:
Order Inquiry.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.pdf.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 7282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-55-0x0000000000DA0000-0x0000000000E16000-memory.dmpFilesize
472KB
-
memory/1184-56-0x0000000000DA0000-0x0000000000E16000-memory.dmpFilesize
472KB
-
memory/1184-57-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/1824-58-0x0000000000000000-mapping.dmp
-
memory/1824-59-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB