Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
04-01-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
Order Inquiry.pdf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Order Inquiry.pdf.exe
Resource
win10-en-20211208
General
-
Target
Order Inquiry.pdf.exe
-
Size
444KB
-
MD5
d646a7fbfc045a2ca121353d752272fc
-
SHA1
39a2ec43451de6ea144b4b6788d5e465cde5faba
-
SHA256
8f0386a64599a9566543216e7a10713d7b40a3e58d01ca65b33eda5375baa57f
-
SHA512
fce5195dc1a6a5e78650d9ce7bbe68d9f3d108641f35d25db7a213bffe308c0d9176549085fa152351221a9f5abe1f3656cf1520af17880c4d45db8d192642c7
Malware Config
Extracted
matiex
https://api.telegram.org/bot2138776011:AAFUEthpbAgvwobq6WX1JcxgCq52Fx3vD1I/sendMessage?chat_id=2105782844
Signatures
-
Matiex Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2336-115-0x0000000000ED0000-0x0000000000F46000-memory.dmp family_matiex behavioral2/memory/2336-116-0x0000000000ED0000-0x0000000000F46000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Order Inquiry.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 checkip.dyndns.org 12 freegeoip.app 13 freegeoip.app -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Order Inquiry.pdf.exepid process 2336 Order Inquiry.pdf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Order Inquiry.pdf.exepid process 2336 Order Inquiry.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Order Inquiry.pdf.exedescription pid process Token: SeDebugPrivilege 2336 Order Inquiry.pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order Inquiry.pdf.exepid process 2336 Order Inquiry.pdf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Order Inquiry.pdf.exedescription pid process target process PID 2336 wrote to memory of 3248 2336 Order Inquiry.pdf.exe netsh.exe PID 2336 wrote to memory of 3248 2336 Order Inquiry.pdf.exe netsh.exe PID 2336 wrote to memory of 3248 2336 Order Inquiry.pdf.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
Order Inquiry.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe -
outlook_win_path 1 IoCs
Processes:
Order Inquiry.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Inquiry.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.pdf.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2336-115-0x0000000000ED0000-0x0000000000F46000-memory.dmpFilesize
472KB
-
memory/2336-116-0x0000000000ED0000-0x0000000000F46000-memory.dmpFilesize
472KB
-
memory/2336-117-0x0000000005780000-0x000000000581C000-memory.dmpFilesize
624KB
-
memory/2336-118-0x0000000005D20000-0x000000000621E000-memory.dmpFilesize
5.0MB
-
memory/2336-119-0x0000000005890000-0x00000000058F6000-memory.dmpFilesize
408KB
-
memory/2336-120-0x0000000005820000-0x0000000005D1E000-memory.dmpFilesize
5.0MB
-
memory/2336-121-0x00000000070C0000-0x0000000007152000-memory.dmpFilesize
584KB
-
memory/2336-122-0x0000000007080000-0x000000000708A000-memory.dmpFilesize
40KB
-
memory/2336-124-0x0000000007430000-0x00000000075F2000-memory.dmpFilesize
1.8MB
-
memory/3248-123-0x0000000000000000-mapping.dmp