Analysis
-
max time kernel
4294192s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
09-03-2022 14:50
Static task
static1
Behavioral task
behavioral1
Sample
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe
Resource
win7-20220223-en
General
-
Target
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe
-
Size
858KB
-
MD5
10fb987bae3f8513ebd149657ba542ba
-
SHA1
c506b003b7c8a90501be33e4d7477cd0aa50f84d
-
SHA256
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17
-
SHA512
68afde759f6f4a5ccaa44260e96a0c56b53157e58ef9a933dbcded53d0125bc198422c86f16871fc130b836e1172ddd5fbb791a3d7d46ea1d37915cdb3c595b3
Malware Config
Extracted
matiex
https://api.telegram.org/bot1379319539:AAFQ7f96r1-8ijh6-Hym9Weh67R1ZdDQt0g/sendMessage?chat_id=1472166686
Signatures
-
Matiex Main Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-63-0x0000000000400000-0x0000000000478000-memory.dmp family_matiex behavioral1/memory/1748-65-0x0000000000400000-0x0000000000478000-memory.dmp family_matiex behavioral1/memory/1748-67-0x0000000000400000-0x0000000000478000-memory.dmp family_matiex behavioral1/memory/1748-71-0x0000000000400000-0x0000000000478000-memory.dmp family_matiex behavioral1/memory/1748-69-0x0000000000400000-0x0000000000478000-memory.dmp family_matiex -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Drops startup file 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppData.url f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 8 freegeoip.app 9 freegeoip.app -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription pid process target process PID 1928 set thread context of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exef63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exepid process 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exef63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription pid process Token: SeDebugPrivilege 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Token: SeDebugPrivilege 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exepid process 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exef63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription pid process target process PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1928 wrote to memory of 1748 1928 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 1748 wrote to memory of 1368 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe PID 1748 wrote to memory of 1368 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe PID 1748 wrote to memory of 1368 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe PID 1748 wrote to memory of 1368 1748 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
outlook_win_path 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"{path}"2⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1368-74-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1748-67-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1748-65-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1748-73-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/1748-72-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1748-59-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1748-61-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1748-63-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1748-69-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1748-71-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1928-54-0x0000000000230000-0x000000000030C000-memory.dmpFilesize
880KB
-
memory/1928-56-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/1928-58-0x0000000008340000-0x000000000842C000-memory.dmpFilesize
944KB
-
memory/1928-57-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/1928-55-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB