Analysis
-
max time kernel
127s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 02:58
Static task
static1
Behavioral task
behavioral1
Sample
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe
Resource
win10v2004-20220414-en
General
-
Target
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe
-
Size
595KB
-
MD5
84503c47129e8677ea66a686eb18b112
-
SHA1
7568eaa0efd8ee7e68c96039396389677df822da
-
SHA256
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a
-
SHA512
5e782746c48e222c7a991e35cd53efb25c510491995df797e11187d5866b1c76a13a4503c9f1b1d08a55816747d77ec1f2a36bbcfc0c656979830e58d7060ddb
Malware Config
Extracted
matiex
https://api.telegram.org/bot1402180145:AAG6hmg8QGRGiHQwRXC9wKOtIEyFy3aT6ms/sendMessage?chat_id=1299507057
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/996-136-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 checkip.dyndns.org 10 freegeoip.app 11 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exedescription pid process target process PID 456 set thread context of 996 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1696 996 WerFault.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exepid process 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 996 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.execmd.exedescription pid process target process PID 456 wrote to memory of 4432 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe cmd.exe PID 456 wrote to memory of 4432 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe cmd.exe PID 456 wrote to memory of 4432 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe cmd.exe PID 456 wrote to memory of 4380 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe cmd.exe PID 456 wrote to memory of 4380 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe cmd.exe PID 456 wrote to memory of 4380 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe cmd.exe PID 4380 wrote to memory of 3976 4380 cmd.exe schtasks.exe PID 4380 wrote to memory of 3976 4380 cmd.exe schtasks.exe PID 4380 wrote to memory of 3976 4380 cmd.exe schtasks.exe PID 456 wrote to memory of 996 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe MSBuild.exe PID 456 wrote to memory of 996 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe MSBuild.exe PID 456 wrote to memory of 996 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe MSBuild.exe PID 456 wrote to memory of 996 456 23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe"C:\Users\Admin\AppData\Local\Temp\23a7c274f2cc0869be588d6ab18edda7b6e6092a80d62c5c782b4f7d6a2a747a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\039462f71f604c9aaf15be88cc879815.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\039462f71f604c9aaf15be88cc879815.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 21003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 996 -ip 9961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\039462f71f604c9aaf15be88cc879815.xmlFilesize
1KB
MD557e80c1cd83971b009db6462dec561e8
SHA19890fc3fc7b93bb9dce0c624486307cff2a26927
SHA256e6cb647c0aee80cbac58f101ba47620657c8cd58f9a0aa91c6f8a4466e4ebc6f
SHA512acc99eb56c615f669ef933c34ae86a1ba41a5ea5108a211de14107293d0bea7eb45e317bdb9b833b1262a1022fa4aa4462f4f3c6a19fa9481320dbb75ee41dd6
-
memory/456-131-0x00000000008B0000-0x00000000008DC000-memory.dmpFilesize
176KB
-
memory/996-135-0x0000000000000000-mapping.dmp
-
memory/996-136-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/996-137-0x0000000004ED0000-0x0000000004F6C000-memory.dmpFilesize
624KB
-
memory/996-138-0x0000000004F70000-0x0000000004FD6000-memory.dmpFilesize
408KB
-
memory/996-139-0x0000000006420000-0x00000000069C4000-memory.dmpFilesize
5.6MB
-
memory/3976-133-0x0000000000000000-mapping.dmp
-
memory/4380-132-0x0000000000000000-mapping.dmp
-
memory/4432-130-0x0000000000000000-mapping.dmp