Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
09-03-2022 14:50
Static task
static1
Behavioral task
behavioral1
Sample
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe
Resource
win7-20220223-en
General
-
Target
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe
-
Size
858KB
-
MD5
10fb987bae3f8513ebd149657ba542ba
-
SHA1
c506b003b7c8a90501be33e4d7477cd0aa50f84d
-
SHA256
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17
-
SHA512
68afde759f6f4a5ccaa44260e96a0c56b53157e58ef9a933dbcded53d0125bc198422c86f16871fc130b836e1172ddd5fbb791a3d7d46ea1d37915cdb3c595b3
Malware Config
Extracted
matiex
https://api.telegram.org/bot1379319539:AAFQ7f96r1-8ijh6-Hym9Weh67R1ZdDQt0g/sendMessage?chat_id=1472166686
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4428-139-0x0000000000400000-0x0000000000478000-memory.dmp family_matiex -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Drops startup file 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppData.url f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 33 checkip.dyndns.org 37 freegeoip.app 38 freegeoip.app -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription pid process target process PID 2104 set thread context of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exef63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exepid process 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exef63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription pid process Token: SeDebugPrivilege 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe Token: SeDebugPrivilege 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exepid process 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exef63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription pid process target process PID 2104 wrote to memory of 860 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 860 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 860 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 2104 wrote to memory of 4428 2104 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe PID 4428 wrote to memory of 4308 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe PID 4428 wrote to memory of 4308 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe PID 4428 wrote to memory of 4308 4428 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe -
outlook_win_path 1 IoCs
Processes:
f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe"{path}"2⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f63f61ec94af821134ae2a1dd3fdf374f86a61316db15d044e0e343c41d99a17.exe.logMD5
ddde88120da5a6e61cf1c0d1fc3f5c99
SHA1aef94de11f90c3e6a99478c03d24aa355a6d0e52
SHA256353067996dbacb8d3ae38dcc754d06b92e34b8511ebe2fda8c2358bbf6b79924
SHA51264994ad92b4751bf3d580ec683e9387d9f05fe44bcb80c343470e992ac793f94f4811ab7c4f2e7240d40d5fe49df8191b781ef994a7c30df1f80940c7b06e8bd
-
memory/2104-136-0x0000000008AA0000-0x0000000008FCC000-memory.dmpFilesize
5.2MB
-
memory/2104-132-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/2104-133-0x0000000004CE0000-0x0000000004D72000-memory.dmpFilesize
584KB
-
memory/2104-134-0x0000000004CD0000-0x0000000004CDA000-memory.dmpFilesize
40KB
-
memory/2104-135-0x0000000004C00000-0x00000000051A4000-memory.dmpFilesize
5.6MB
-
memory/2104-130-0x0000000000230000-0x000000000030C000-memory.dmpFilesize
880KB
-
memory/2104-137-0x0000000009520000-0x00000000095BC000-memory.dmpFilesize
624KB
-
memory/2104-138-0x0000000009630000-0x0000000009696000-memory.dmpFilesize
408KB
-
memory/2104-131-0x00000000051B0000-0x0000000005754000-memory.dmpFilesize
5.6MB
-
memory/4428-139-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4428-141-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/4428-142-0x0000000005940000-0x0000000005EE4000-memory.dmpFilesize
5.6MB
-
memory/4428-143-0x0000000007680000-0x0000000007842000-memory.dmpFilesize
1.8MB