Analysis
-
max time kernel
119s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe
Resource
win10v2004-20220414-en
General
-
Target
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe
-
Size
714KB
-
MD5
c31ef8a4e6c0320263b90436ca3236be
-
SHA1
90ba9958ec278f51a6f2bfc99c0de908d3d4fa5b
-
SHA256
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1
-
SHA512
e78054eea698da91e6b85e60e83e940bf8fd88b73ad08031831d9a85b097c5e55d066cde0792ec87c1c5e248fb04fee36a96c85891b2dd14e4a334ff69ad6b24
Malware Config
Extracted
matiex
https://api.telegram.org/bot\MK-Voice.mp3/sendMessage?chat_id=A
Signatures
-
Matiex Main Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-62-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex behavioral1/memory/1704-63-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex behavioral1/memory/1704-65-0x000000000046DC7E-mapping.dmp family_matiex behavioral1/memory/1704-64-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex behavioral1/memory/1704-67-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex behavioral1/memory/1704-69-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 freegeoip.app 9 freegeoip.app 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exedescription pid process target process PID 952 set thread context of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 388 1704 WerFault.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exepid process 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe Token: SeDebugPrivilege 1704 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exeMSBuild.exedescription pid process target process PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 952 wrote to memory of 1704 952 205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe MSBuild.exe PID 1704 wrote to memory of 388 1704 MSBuild.exe WerFault.exe PID 1704 wrote to memory of 388 1704 MSBuild.exe WerFault.exe PID 1704 wrote to memory of 388 1704 MSBuild.exe WerFault.exe PID 1704 wrote to memory of 388 1704 MSBuild.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe"C:\Users\Admin\AppData\Local\Temp\205146ce59425a87371d53d6a5ff9be127a2914b3e931361065ba56d7f84acc1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 17443⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-71-0x0000000000000000-mapping.dmp
-
memory/952-54-0x0000000001180000-0x0000000001238000-memory.dmpFilesize
736KB
-
memory/952-55-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/952-56-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/952-57-0x0000000000E20000-0x0000000000E90000-memory.dmpFilesize
448KB
-
memory/952-58-0x00000000056D0000-0x000000000577A000-memory.dmpFilesize
680KB
-
memory/1704-60-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-62-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-63-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-65-0x000000000046DC7E-mapping.dmp
-
memory/1704-64-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-67-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-69-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1704-59-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB