Analysis
-
max time kernel
72s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
Tax Invoices IN102738 IN102739 IN102740 (2).exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Tax Invoices IN102738 IN102739 IN102740 (2).exe
Resource
win10v2004-20220414-en
General
-
Target
Tax Invoices IN102738 IN102739 IN102740 (2).exe
-
Size
867KB
-
MD5
1edc97d794a36b1e6c0c4757f56becad
-
SHA1
8ff5c4d412ac10443a79e02f80579c1d5f0c53e2
-
SHA256
d2e9e5d1c73e145f6ca508dd8f1397ea4ce5fa1172468889f65133f0af0d08ea
-
SHA512
e820ea714c71e671557e3e2b32c4c6690cd48f04cd3c5480cf4822a3acb51e522577fc3e500f7fe4b473f7c8a210987b36268ec8bcbe08c8f4766dc3f9876917
Malware Config
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
[email protected] - Password:
italik2015
Signatures
-
Matiex Main Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-62-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/1988-63-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/1988-65-0x000000000047023E-mapping.dmp family_matiex behavioral1/memory/1988-64-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/1988-67-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex behavioral1/memory/1988-69-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Tax Invoices IN102738 IN102739 IN102740 (2).exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Tax Invoices IN102738 IN102739 IN102740 (2).exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Tax Invoices IN102738 IN102739 IN102740 (2).exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 8 freegeoip.app 9 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exedescription pid process target process PID 1540 set thread context of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1200 1988 WerFault.exe Tax Invoices IN102738 IN102739 IN102740 (2).exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exepid process 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exeTax Invoices IN102738 IN102739 IN102740 (2).exedescription pid process Token: SeDebugPrivilege 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Token: SeDebugPrivilege 1988 Tax Invoices IN102738 IN102739 IN102740 (2).exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exeTax Invoices IN102738 IN102739 IN102740 (2).exedescription pid process target process PID 1540 wrote to memory of 2036 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe schtasks.exe PID 1540 wrote to memory of 2036 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe schtasks.exe PID 1540 wrote to memory of 2036 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe schtasks.exe PID 1540 wrote to memory of 2036 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe schtasks.exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1540 wrote to memory of 1988 1540 Tax Invoices IN102738 IN102739 IN102740 (2).exe Tax Invoices IN102738 IN102739 IN102740 (2).exe PID 1988 wrote to memory of 1200 1988 Tax Invoices IN102738 IN102739 IN102740 (2).exe WerFault.exe PID 1988 wrote to memory of 1200 1988 Tax Invoices IN102738 IN102739 IN102740 (2).exe WerFault.exe PID 1988 wrote to memory of 1200 1988 Tax Invoices IN102738 IN102739 IN102740 (2).exe WerFault.exe PID 1988 wrote to memory of 1200 1988 Tax Invoices IN102738 IN102739 IN102740 (2).exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Tax Invoices IN102738 IN102739 IN102740 (2).exe -
outlook_win_path 1 IoCs
Processes:
Tax Invoices IN102738 IN102739 IN102740 (2).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Tax Invoices IN102738 IN102739 IN102740 (2).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax Invoices IN102738 IN102739 IN102740 (2).exe"C:\Users\Admin\AppData\Local\Temp\Tax Invoices IN102738 IN102739 IN102740 (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eRRgZe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1E0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Tax Invoices IN102738 IN102739 IN102740 (2).exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 18003⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD1E0.tmpFilesize
1KB
MD57d1a81a8119dc78d336245eea7a4645b
SHA11f8cc5b0465edec35bdc8067615e63af1399672f
SHA25601cfcabd28339622098492f7e54ad227ddcee837917b4d049bb822e54bd6d294
SHA512572a9bb24f94829a84c7b6238a2885c59e78bf19055f67c164cffbb4d486b711395130e1090f739267a33517f4152c931926c9baf9fd0652381a3fb462bc44a2
-
memory/1200-71-0x0000000000000000-mapping.dmp
-
memory/1540-54-0x0000000000E40000-0x0000000000F22000-memory.dmpFilesize
904KB
-
memory/1540-55-0x00000000008E0000-0x00000000008EA000-memory.dmpFilesize
40KB
-
memory/1540-56-0x0000000004970000-0x0000000004A1A000-memory.dmpFilesize
680KB
-
memory/1988-65-0x000000000047023E-mapping.dmp
-
memory/1988-60-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-62-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-63-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-59-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-64-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-67-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-69-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1988-70-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/2036-57-0x0000000000000000-mapping.dmp