Analysis
-
max time kernel
71s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 14:59
Static task
static1
Behavioral task
behavioral1
Sample
546632 - MARITIME WK-2 OCT.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
546632 - MARITIME WK-2 OCT.exe
Resource
win10v2004-20220414-en
General
-
Target
546632 - MARITIME WK-2 OCT.exe
-
Size
773KB
-
MD5
910f1f2bdb64a368db77afd1491ed7e3
-
SHA1
c9e60b441c2a1ccabe57454f9e737cdbb74d372f
-
SHA256
d033f6fc657267d6aa462537cc47ea3f7379b86cbadf6499199c7e6906b107b3
-
SHA512
62a0c2165b6e71a3406801b99fa1a1d1ecb57ed92413084569b1591c5c5c5cb691fa31f5cee5a2f5b9f1ac4ce7ff626ec59427eee96f014cebf391f1cc278ac6
Malware Config
Extracted
matiex
Protocol: smtp- Host:
mail.avicorrpinc.com - Port:
587 - Username:
[email protected] - Password:
admin@abc123 - Email To:
[email protected]
Signatures
-
Matiex Main Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1448-62-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1448-63-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1448-64-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1448-65-0x000000000046E01E-mapping.dmp family_matiex behavioral1/memory/1448-67-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1448-69-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 8 freegeoip.app 9 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
546632 - MARITIME WK-2 OCT.exedescription pid process target process PID 812 set thread context of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1004 1448 WerFault.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
546632 - MARITIME WK-2 OCT.exepid process 812 546632 - MARITIME WK-2 OCT.exe 812 546632 - MARITIME WK-2 OCT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
546632 - MARITIME WK-2 OCT.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 812 546632 - MARITIME WK-2 OCT.exe Token: SeDebugPrivilege 1448 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
546632 - MARITIME WK-2 OCT.exeMSBuild.exedescription pid process target process PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 812 wrote to memory of 1448 812 546632 - MARITIME WK-2 OCT.exe MSBuild.exe PID 1448 wrote to memory of 1004 1448 MSBuild.exe WerFault.exe PID 1448 wrote to memory of 1004 1448 MSBuild.exe WerFault.exe PID 1448 wrote to memory of 1004 1448 MSBuild.exe WerFault.exe PID 1448 wrote to memory of 1004 1448 MSBuild.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\546632 - MARITIME WK-2 OCT.exe"C:\Users\Admin\AppData\Local\Temp\546632 - MARITIME WK-2 OCT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 17363⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-54-0x00000000001B0000-0x0000000000278000-memory.dmpFilesize
800KB
-
memory/812-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/812-56-0x00000000002B0000-0x00000000002BA000-memory.dmpFilesize
40KB
-
memory/812-57-0x0000000005190000-0x000000000520C000-memory.dmpFilesize
496KB
-
memory/812-58-0x0000000005C60000-0x0000000005D0C000-memory.dmpFilesize
688KB
-
memory/1004-71-0x0000000000000000-mapping.dmp
-
memory/1448-60-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1448-62-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1448-63-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1448-64-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1448-65-0x000000000046E01E-mapping.dmp
-
memory/1448-67-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1448-69-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1448-59-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB