General
-
Target
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf
-
Size
206KB
-
Sample
220307-mwllnadec9
-
MD5
386f1bf4e2814eeee955fa8003fb7753
-
SHA1
5549b5b787a80012e9d6da305567a77d790cc9a4
-
SHA256
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf
-
SHA512
fb05890dd28745f3c294a591394e86b8aed61bc7b7dd265ea3bc147303d2b95808cf02093c6c628cb02a6607909415a84a1819c7998c1ec5f0e98bc8852b4509
Static task
static1
Behavioral task
behavioral1
Sample
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
matiex
Protocol: smtp- Host:
pro02.emailserver.vn - Port:
587 - Username:
[email protected] - Password:
lv123456 - Email To:
[email protected]
Targets
-
-
Target
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf
-
Size
206KB
-
MD5
386f1bf4e2814eeee955fa8003fb7753
-
SHA1
5549b5b787a80012e9d6da305567a77d790cc9a4
-
SHA256
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf
-
SHA512
fb05890dd28745f3c294a591394e86b8aed61bc7b7dd265ea3bc147303d2b95808cf02093c6c628cb02a6607909415a84a1819c7998c1ec5f0e98bc8852b4509
-
Matiex Main Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-