Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
08-03-2022 19:27
Static task
static1
Behavioral task
behavioral1
Sample
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
Resource
win10v2004-en-20220113
General
-
Target
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
-
Size
252KB
-
MD5
2fdcd6f63014c05331365fe96538c010
-
SHA1
107473be86d052f460685f9e5879aed530433b5b
-
SHA256
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd
-
SHA512
da553a61ca0e9cc877941c22652f0ae4917c05e4b0f699e4518dfd60b139e06a17747cfb26dce67685d41f5164d49eedae63e94c310444ce7a24b3783b5283f5
Malware Config
Extracted
matiex
Protocol: smtp- Host:
pro02.emailserver.vn - Port:
587 - Username:
[email protected] - Password:
lv123456 - Email To:
[email protected]
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4484-137-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation WScript.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription pid process target process PID 2864 set thread context of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exepowershell.exepid process 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3344 powershell.exe 3344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exepowershell.exe3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription pid process Token: SeDebugPrivilege 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeDebugPrivilege 4484 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exeWScript.exedescription pid process target process PID 2864 wrote to memory of 4212 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 2864 wrote to memory of 4212 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 2864 wrote to memory of 4212 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe WScript.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 2864 wrote to memory of 4484 2864 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe PID 4212 wrote to memory of 3344 4212 WScript.exe powershell.exe PID 4212 wrote to memory of 3344 4212 WScript.exe powershell.exe PID 4212 wrote to memory of 3344 4212 WScript.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe -
outlook_win_path 1 IoCs
Processes:
3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe"C:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zLonkuquntjipat.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exeC:\Users\Admin\AppData\Local\Temp\3f3a8442b3a36cf557f9535d67c11a1040392df889587b2f6341d682b4cb47dd.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zLonkuquntjipat.vbsMD5
570e1760047887d4773c02a7f0c0a9ef
SHA1ea36b58136c15c0c38ca496e5fd55e9de62073dc
SHA256c14774447472f5eec655d2046e6e4930b3bed4877de328d4f8a58416b7144db2
SHA512aeb14674534d2a4cc6d58fe733a4a6085d031f1a45ddad9e3e8fa312879b6cd8a1dff962529639b8ebea98d1ca8a9d42c0893d267696a70c7e9db696980b9ef3
-
memory/2864-130-0x00000000006F0000-0x0000000000736000-memory.dmpFilesize
280KB
-
memory/2864-131-0x0000000004FC0000-0x0000000005026000-memory.dmpFilesize
408KB
-
memory/2864-132-0x0000000074730000-0x0000000074EE0000-memory.dmpFilesize
7.7MB
-
memory/2864-133-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2864-134-0x00000000056B0000-0x0000000005726000-memory.dmpFilesize
472KB
-
memory/2864-135-0x0000000005730000-0x000000000574E000-memory.dmpFilesize
120KB
-
memory/3344-154-0x0000000008190000-0x000000000880A000-memory.dmpFilesize
6.5MB
-
memory/3344-150-0x00000000052B5000-0x00000000052B7000-memory.dmpFilesize
8KB
-
memory/3344-161-0x0000000007E60000-0x0000000007E68000-memory.dmpFilesize
32KB
-
memory/3344-160-0x0000000007E80000-0x0000000007E9A000-memory.dmpFilesize
104KB
-
memory/3344-141-0x0000000005260000-0x0000000005296000-memory.dmpFilesize
216KB
-
memory/3344-142-0x00000000058F0000-0x0000000005F18000-memory.dmpFilesize
6.2MB
-
memory/3344-143-0x00000000060A0000-0x00000000060C2000-memory.dmpFilesize
136KB
-
memory/3344-144-0x0000000006140000-0x00000000061A6000-memory.dmpFilesize
408KB
-
memory/3344-159-0x0000000007D70000-0x0000000007D7E000-memory.dmpFilesize
56KB
-
memory/3344-146-0x0000000074730000-0x0000000074EE0000-memory.dmpFilesize
7.7MB
-
memory/3344-147-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3344-148-0x00000000052B2000-0x00000000052B3000-memory.dmpFilesize
4KB
-
memory/3344-149-0x00000000055C0000-0x00000000055DE000-memory.dmpFilesize
120KB
-
memory/3344-158-0x0000000007DC0000-0x0000000007E56000-memory.dmpFilesize
600KB
-
memory/3344-151-0x0000000006E20000-0x0000000006E52000-memory.dmpFilesize
200KB
-
memory/3344-152-0x000000006FF80000-0x000000006FFCC000-memory.dmpFilesize
304KB
-
memory/3344-153-0x0000000006E00000-0x0000000006E1E000-memory.dmpFilesize
120KB
-
memory/3344-157-0x000000007EE40000-0x000000007EE41000-memory.dmpFilesize
4KB
-
memory/3344-155-0x0000000007B40000-0x0000000007B5A000-memory.dmpFilesize
104KB
-
memory/3344-156-0x0000000007BB0000-0x0000000007BBA000-memory.dmpFilesize
40KB
-
memory/4484-137-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/4484-138-0x0000000005170000-0x000000000520C000-memory.dmpFilesize
624KB
-
memory/4484-145-0x0000000005210000-0x00000000057B4000-memory.dmpFilesize
5.6MB
-
memory/4484-140-0x00000000057C0000-0x0000000005D64000-memory.dmpFilesize
5.6MB
-
memory/4484-139-0x0000000074730000-0x0000000074EE0000-memory.dmpFilesize
7.7MB
-
memory/4484-162-0x0000000006940000-0x0000000006B02000-memory.dmpFilesize
1.8MB
-
memory/4484-163-0x0000000006810000-0x00000000068A2000-memory.dmpFilesize
584KB
-
memory/4484-164-0x00000000067C0000-0x00000000067CA000-memory.dmpFilesize
40KB