agenttesla | 317fec4108f6d85caa5c1589b983a87dc665140390975d2f96e54a8ab1ab2d34

General

Target

000000090000-0990.exe
Size

1.5MB
MD5

dca3732857d10782f68df4c3e1b757a9
SHA1

95a0c95fee10a8e37fb0bcabff6e4b10924285d2
SHA256

c62943499b7fed80bf4e37ab525b622ef4fb7cc6b82ddb7b8d6fe75dabcaf363
SHA512

5ada13a7e67d59e38d57fccddac36cad71d2ccfff45945cc1274d310ecf4a79f756e865526a1d9d672d6200d0ae4215e5b7754b0b29e88debb5f9db873154ea0

Score

10^/10

agenttesla matiex snakekeylogger collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
srvc13.turhost.com
Port:
587
Username:
[email protected]
Password:
italik2015

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe	family_matiex
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe	family_matiex
behavioral2/memory/4164-140-0x0000000000400000-0x000000000050C000-memory.dmp	family_matiex
behavioral2/memory/2504-143-0x0000000000490000-0x0000000000506000-memory.dmp	family_matiex

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4.0.exe	family_agenttesla
C:\Users\Admin\AppData\Local\Temp\4.0.exe	family_agenttesla
behavioral2/memory/4164-140-0x0000000000400000-0x000000000050C000-memory.dmp	family_agenttesla
behavioral2/memory/4336-141-0x0000000000380000-0x00000000003BC000-memory.dmp	family_agenttesla

Executes dropped EXE 3 IoCs

Processes:

4.0.exebilgi snake 2021.exeMATIEX GODISOD 4.0 .exe

pid process

4336 4.0.exe
1356 bilgi snake 2021.exe
2504 MATIEX GODISOD 4.0 .exe

pid	process
4336	4.0.exe
1356	bilgi snake 2021.exe
2504	MATIEX GODISOD 4.0 .exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

000000090000-0990.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	000000090000-0990.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

Processes:

MATIEX GODISOD 4.0 .exebilgi snake 2021.exe4.0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MATIEX GODISOD 4.0 .exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bilgi snake 2021.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MATIEX GODISOD 4.0 .exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bilgi snake 2021.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bilgi snake 2021.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4.0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MATIEX GODISOD 4.0 .exe

Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 checkip.dyndns.org
23 freegeoip.app
24 freegeoip.app
25 freegeoip.app
71 api.ipify.org
72 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

000000090000-0990.exe

description pid process target process

PID 1296 set thread context of 4164 1296 000000090000-0990.exe MSBuild.exe

flow	ioc
17	checkip.dyndns.org
23	freegeoip.app
24	freegeoip.app
25	freegeoip.app
71	api.ipify.org
72	api.ipify.org

description	pid	process	target process
PID 1296 set thread context of 4164	1296	000000090000-0990.exe	MSBuild.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4512 schtasks.exe

pid	process
4512	schtasks.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

4.0.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4.0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4.0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4.0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	4.0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bilgi snake 2021.exe4.0.exeMATIEX GODISOD 4.0 .exe

pid process

1356 bilgi snake 2021.exe
4336 4.0.exe
4336 4.0.exe
2504 MATIEX GODISOD 4.0 .exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

000000090000-0990.exe

pid process

1296 000000090000-0990.exe

pid	process
1356	bilgi snake 2021.exe
4336	4.0.exe
4336	4.0.exe
2504	MATIEX GODISOD 4.0 .exe

pid	process
1296	000000090000-0990.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

bilgi snake 2021.exe4.0.exeMATIEX GODISOD 4.0 .exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1356	bilgi snake 2021.exe
Token: SeDebugPrivilege	4336	4.0.exe
Token: SeDebugPrivilege	2504	MATIEX GODISOD 4.0 .exe
Token: SeShutdownPrivilege	1724	svchost.exe
Token: SeCreatePagefilePrivilege	1724	svchost.exe
Token: SeShutdownPrivilege	1724	svchost.exe
Token: SeCreatePagefilePrivilege	1724	svchost.exe
Token: SeShutdownPrivilege	1724	svchost.exe
Token: SeCreatePagefilePrivilege	1724	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

4164 MSBuild.exe

pid	process
4164	MSBuild.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

000000090000-0990.execmd.exeMSBuild.exeMATIEX GODISOD 4.0 .exe

description	pid	process	target process
PID 1296 wrote to memory of 2796	1296	000000090000-0990.exe	cmd.exe
PID 1296 wrote to memory of 2796	1296	000000090000-0990.exe	cmd.exe
PID 1296 wrote to memory of 2796	1296	000000090000-0990.exe	cmd.exe
PID 1296 wrote to memory of 4164	1296	000000090000-0990.exe	MSBuild.exe
PID 1296 wrote to memory of 4164	1296	000000090000-0990.exe	MSBuild.exe
PID 1296 wrote to memory of 4164	1296	000000090000-0990.exe	MSBuild.exe
PID 1296 wrote to memory of 4164	1296	000000090000-0990.exe	MSBuild.exe
PID 2796 wrote to memory of 4512	2796	cmd.exe	schtasks.exe
PID 2796 wrote to memory of 4512	2796	cmd.exe	schtasks.exe
PID 2796 wrote to memory of 4512	2796	cmd.exe	schtasks.exe
PID 4164 wrote to memory of 4336	4164	MSBuild.exe	4.0.exe
PID 4164 wrote to memory of 4336	4164	MSBuild.exe	4.0.exe
PID 4164 wrote to memory of 4336	4164	MSBuild.exe	4.0.exe
PID 4164 wrote to memory of 1356	4164	MSBuild.exe	bilgi snake 2021.exe
PID 4164 wrote to memory of 1356	4164	MSBuild.exe	bilgi snake 2021.exe
PID 4164 wrote to memory of 1356	4164	MSBuild.exe	bilgi snake 2021.exe
PID 4164 wrote to memory of 2504	4164	MSBuild.exe	MATIEX GODISOD 4.0 .exe
PID 4164 wrote to memory of 2504	4164	MSBuild.exe	MATIEX GODISOD 4.0 .exe
PID 4164 wrote to memory of 2504	4164	MSBuild.exe	MATIEX GODISOD 4.0 .exe
PID 2504 wrote to memory of 204	2504	MATIEX GODISOD 4.0 .exe	netsh.exe
PID 2504 wrote to memory of 204	2504	MATIEX GODISOD 4.0 .exe	netsh.exe
PID 2504 wrote to memory of 204	2504	MATIEX GODISOD 4.0 .exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

4.0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4.0.exe

outlook_win_path 1 IoCs

Processes:

4.0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4.0.exe

C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe
"C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml"
    3⤵
    - Creates scheduled task(s)
    PID:4512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\000000090000-0990.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Local\Temp\4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\4.0.exe" 0
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe
    "C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe" 0
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe
    "C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe" 0
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\39f3642c01e5456a9e5b83f9a108aa0b.xml

MD5
c673ecc050b1038f727be09aa61cb4b1

SHA1
d2960b6d62810ce8745f6353d6924ae79af01e7e

SHA256
8f2648a15094c455e21cab1ba01133d9d9d17caaab1bb2ee782da160898880e4

SHA512
d6b75c8068c3d9208585413f7a799f69b05e141446d09925f9aae34ac65c0745f37196ec3aeb369e2c8dea6ddfcc55c07fe8f227a06d79dfa408f3d2315c29e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.0.exe

MD5
bd5fe63e3666a489e7a221647f6f3807

SHA1
52a8db03aa3db1b9a287688afeffa9f041c3811c

SHA256
5a46b373a0a0894870f5a63e52477dbe71e78efe35aa373c30d2edbdf3e35f9e

SHA512
631a0ce258d4ae4ab81ca69ff344eb8733e5507b4f88c27f8b7491bed8fe2362f944bbdff51abf3089c03a67149a102cce8989d985e60a9531b77a7f260b90e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.0.exe

MD5
bd5fe63e3666a489e7a221647f6f3807

SHA1
52a8db03aa3db1b9a287688afeffa9f041c3811c

SHA256
5a46b373a0a0894870f5a63e52477dbe71e78efe35aa373c30d2edbdf3e35f9e

SHA512
631a0ce258d4ae4ab81ca69ff344eb8733e5507b4f88c27f8b7491bed8fe2362f944bbdff51abf3089c03a67149a102cce8989d985e60a9531b77a7f260b90e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe

MD5
f615aa95251fc14492843942a588614c

SHA1
296669e81c271762d5068f8a9ecbb354ffc335c9

SHA256
e0b3bd3f2fadd3ef560c7dc1c13e1f50351e8df61139eb8e6367badf7689e71b

SHA512
ad58e4b52132a0c186ff14040bf95cc1c8d65b307c90a6004e1d58e365c91635d998e3259cb5575c79aeb0aed08dd55a827edadfbef7f0ecfbc500dd9b42b6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MATIEX GODISOD 4.0 .exe

MD5
f615aa95251fc14492843942a588614c

SHA1
296669e81c271762d5068f8a9ecbb354ffc335c9

SHA256
e0b3bd3f2fadd3ef560c7dc1c13e1f50351e8df61139eb8e6367badf7689e71b

SHA512
ad58e4b52132a0c186ff14040bf95cc1c8d65b307c90a6004e1d58e365c91635d998e3259cb5575c79aeb0aed08dd55a827edadfbef7f0ecfbc500dd9b42b6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe

MD5
e33e63bda6a3976ecadfa9ee6f096944

SHA1
68b683bb325ae9c21f471593f007c797a02dc497

SHA256
c2d3a6b20eb4bc377bf9be955b23615492786be0613373bfc7f440ab872a8142

SHA512
91b672e86e30804e7e632d79e78c99ac9a0ee7c8468ad9eecc555f15773bb535d430f0c39efa61d9afdec7bb3f05f97cd18126e6c16eb6b1036e131b8f256142

Download Submit
C:\Users\Admin\AppData\Local\Temp\bilgi snake 2021.exe

MD5
e33e63bda6a3976ecadfa9ee6f096944

SHA1
68b683bb325ae9c21f471593f007c797a02dc497

SHA256
c2d3a6b20eb4bc377bf9be955b23615492786be0613373bfc7f440ab872a8142

SHA512
91b672e86e30804e7e632d79e78c99ac9a0ee7c8468ad9eecc555f15773bb535d430f0c39efa61d9afdec7bb3f05f97cd18126e6c16eb6b1036e131b8f256142

Download Submit
memory/1296-130-0x0000000000F5B000-0x0000000000F60000-memory.dmp

Filesize
20KB

Download
memory/1356-153-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/1356-142-0x0000000000500000-0x000000000056A000-memory.dmp

Filesize
424KB

Download
memory/1356-158-0x00000000061F0000-0x00000000061FA000-memory.dmp

Filesize
40KB

Download
memory/1356-157-0x0000000006380000-0x0000000006542000-memory.dmp

Filesize
1.8MB

Download
memory/1356-147-0x0000000072E2E000-0x0000000072E2F000-memory.dmp

Filesize
4KB

Download
memory/1356-148-0x0000000005470000-0x0000000005A14000-memory.dmp

Filesize
5.6MB

Download
memory/1724-154-0x00000149CDF60000-0x00000149CDF70000-memory.dmp

Filesize
64KB

Download
memory/1724-156-0x00000149D0BA0000-0x00000149D0BA4000-memory.dmp

Filesize
16KB

Download
memory/1724-155-0x00000149CE520000-0x00000149CE530000-memory.dmp

Filesize
64KB

Download
memory/2504-151-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/2504-150-0x0000000004E40000-0x0000000004EA6000-memory.dmp

Filesize
408KB

Download
memory/2504-146-0x0000000072E2E000-0x0000000072E2F000-memory.dmp

Filesize
4KB

Download
memory/2504-144-0x0000000004D30000-0x0000000004DCC000-memory.dmp

Filesize
624KB

Download
memory/2504-143-0x0000000000490000-0x0000000000506000-memory.dmp

Filesize
472KB

Download
memory/4164-140-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/4336-141-0x0000000000380000-0x00000000003BC000-memory.dmp

Filesize
240KB

Download
memory/4336-152-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/4336-149-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Filesize
584KB

Download
memory/4336-145-0x0000000072E2E000-0x0000000072E2F000-memory.dmp

Filesize
4KB

Download
memory/4336-159-0x0000000006670000-0x00000000066C0000-memory.dmp

Filesize
320KB

Download
memory/4336-160-0x0000000004F41000-0x0000000004F42000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads