Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-03-2022 19:27
Static task
static1
Behavioral task
behavioral1
Sample
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
Resource
win10v2004-en-20220113
General
-
Target
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
-
Size
252KB
-
MD5
2fdcd6f63014c05331365fe96538c010
-
SHA1
107473be86d052f460685f9e5879aed530433b5b
-
SHA256
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd
-
SHA512
da553a61ca0e9cc877941c22652f0ae4917c05e4b0f699e4518dfd60b139e06a17747cfb26dce67685d41f5164d49eedae63e94c310444ce7a24b3783b5283f5
Malware Config
Extracted
matiex
Protocol: smtp- Host:
pro02.emailserver.vn - Port:
587 - Username:
[email protected] - Password:
lv123456 - Email To:
[email protected]
Signatures
-
Matiex Main Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/308-66-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/308-68-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/308-70-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/308-72-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/308-74-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 8 freegeoip.app 9 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription pid process target process PID 1960 set thread context of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exepowershell.exe3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exepid process 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 1736 powershell.exe 308 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exepowershell.exedescription pid process Token: SeDebugPrivilege 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe Token: SeDebugPrivilege 308 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe Token: SeDebugPrivilege 1736 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exeWScript.exedescription pid process target process PID 1960 wrote to memory of 1084 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 1960 wrote to memory of 1084 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 1960 wrote to memory of 1084 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 1960 wrote to memory of 1084 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1960 wrote to memory of 308 1960 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 1084 wrote to memory of 1736 1084 WScript.exe powershell.exe PID 1084 wrote to memory of 1736 1084 WScript.exe powershell.exe PID 1084 wrote to memory of 1736 1084 WScript.exe powershell.exe PID 1084 wrote to memory of 1736 1084 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe"C:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zLonkuquntjipat.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exeC:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zLonkuquntjipat.vbsMD5
570e1760047887d4773c02a7f0c0a9ef
SHA1ea36b58136c15c0c38ca496e5fd55e9de62073dc
SHA256c14774447472f5eec655d2046e6e4930b3bed4877de328d4f8a58416b7144db2
SHA512aeb14674534d2a4cc6d58fe733a4a6085d031f1a45ddad9e3e8fa312879b6cd8a1dff962529639b8ebea98d1ca8a9d42c0893d267696a70c7e9db696980b9ef3
-
memory/308-68-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-64-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-66-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-76-0x0000000074B40000-0x000000007522E000-memory.dmpFilesize
6.9MB
-
memory/308-74-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-72-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-62-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-70-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/308-81-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/1084-61-0x0000000076511000-0x0000000076513000-memory.dmpFilesize
8KB
-
memory/1736-80-0x0000000002421000-0x0000000002422000-memory.dmpFilesize
4KB
-
memory/1736-78-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/1736-77-0x0000000071D80000-0x000000007232B000-memory.dmpFilesize
5.7MB
-
memory/1736-79-0x0000000071D80000-0x000000007232B000-memory.dmpFilesize
5.7MB
-
memory/1736-82-0x0000000002422000-0x0000000002424000-memory.dmpFilesize
8KB
-
memory/1960-57-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/1960-56-0x0000000000B60000-0x0000000000BA6000-memory.dmpFilesize
280KB
-
memory/1960-59-0x0000000000460000-0x0000000000484000-memory.dmpFilesize
144KB
-
memory/1960-55-0x0000000074B40000-0x000000007522E000-memory.dmpFilesize
6.9MB
-
memory/1960-58-0x00000000003A0000-0x00000000003B2000-memory.dmpFilesize
72KB