Analysis
-
max time kernel
4294180s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
07-03-2022 10:48
Static task
static1
Behavioral task
behavioral1
Sample
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe
Resource
win10v2004-en-20220112
General
-
Target
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe
-
Size
206KB
-
MD5
386f1bf4e2814eeee955fa8003fb7753
-
SHA1
5549b5b787a80012e9d6da305567a77d790cc9a4
-
SHA256
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf
-
SHA512
fb05890dd28745f3c294a591394e86b8aed61bc7b7dd265ea3bc147303d2b95808cf02093c6c628cb02a6607909415a84a1819c7998c1ec5f0e98bc8852b4509
Malware Config
Extracted
matiex
Protocol: smtp- Host:
pro02.emailserver.vn - Port:
587 - Username:
[email protected] - Password:
lv123456 - Email To:
[email protected]
Signatures
-
Matiex Main Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1000-65-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1000-67-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1000-69-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1000-71-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1000-73-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\P.O 0012150746 = "\"C:\\Users\\Admin\\AppData\\Roaming\\P.O 0012150746 .exe\"" 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 checkip.dyndns.org 12 freegeoip.app 13 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exedescription pid process target process PID 756 set thread context of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exepowershell.exe44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exepid process 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 1396 powershell.exe 1000 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exepowershell.exedescription pid process Token: SeDebugPrivilege 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe Token: SeDebugPrivilege 1000 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe Token: SeDebugPrivilege 1396 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exeWScript.exedescription pid process target process PID 756 wrote to memory of 1336 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe WScript.exe PID 756 wrote to memory of 1336 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe WScript.exe PID 756 wrote to memory of 1336 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe WScript.exe PID 756 wrote to memory of 1336 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe WScript.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 756 wrote to memory of 1000 756 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe PID 1336 wrote to memory of 1396 1336 WScript.exe powershell.exe PID 1336 wrote to memory of 1396 1336 WScript.exe powershell.exe PID 1336 wrote to memory of 1396 1336 WScript.exe powershell.exe PID 1336 wrote to memory of 1396 1336 WScript.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe -
outlook_win_path 1 IoCs
Processes:
44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe"C:\Users\Admin\AppData\Local\Temp\44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zFkybotkiljgxan.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\P.O 0012150746 .exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exeC:\Users\Admin\AppData\Local\Temp\44a661eff11b329b93eccf84e1eb9383201f51ac7751873ca740b46d7493edaf.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1000
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zFkybotkiljgxan.vbsMD5
88cb55eef1ee371e2ac5851bbc8b542e
SHA113ccb1f3bd4d11ca953c5470af7a5cd1d3de1b49
SHA2569cf37b29f3f9c930de5fa89ea0bb38db2b71547ce8739fb72b6ea1b9e7b03b8a
SHA512dd3667da0c242cf68bb5568e03f8618165c5eedf4556dba0e3de901e6b32f066100a33924a6320990328df469654d7fa4dbdef388a0a95533688e5e5b4ffc63b
-
memory/756-54-0x0000000000AC0000-0x0000000000AFA000-memory.dmpFilesize
232KB
-
memory/756-55-0x00000000740E0000-0x00000000747CE000-memory.dmpFilesize
6.9MB
-
memory/756-56-0x0000000000300000-0x0000000000308000-memory.dmpFilesize
32KB
-
memory/756-57-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/756-58-0x0000000000620000-0x0000000000644000-memory.dmpFilesize
144KB
-
memory/1000-67-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-73-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-63-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-65-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-60-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-69-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-71-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1000-79-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1000-75-0x00000000740E0000-0x00000000747CE000-memory.dmpFilesize
6.9MB
-
memory/1336-62-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1396-77-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/1396-76-0x00000000706B0000-0x0000000070C5B000-memory.dmpFilesize
5.7MB
-
memory/1396-81-0x0000000002572000-0x0000000002574000-memory.dmpFilesize
8KB
-
memory/1396-80-0x0000000002571000-0x0000000002572000-memory.dmpFilesize
4KB
-
memory/1396-78-0x00000000706B0000-0x0000000070C5B000-memory.dmpFilesize
5.7MB