Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 20:44
Static task
static1
Behavioral task
behavioral1
Sample
gsxp5mkd0ACsDub.exe
Resource
win7-20220414-en
General
-
Target
gsxp5mkd0ACsDub.exe
-
Size
949KB
-
MD5
ac9577cdc33e7cf5cd3193d9a02b5ee6
-
SHA1
3ca264ffe003d0a1c3b196169ed5cf672b3b1794
-
SHA256
e1f6a0b698c957d92bc86fdaf9add81405fc26c716f691fb34148485a93de97c
-
SHA512
0f9b55ff971e618a53f2366f2a2dc7236ef513dffd561e0e0eb97c3166a738ae754ad9ea83e9d8803639c91f8bc8b90a843ca1a6fb854c7b8b978e88edb3e54a
Malware Config
Extracted
matiex
https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-137-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
gsxp5mkd0ACsDub.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gsxp5mkd0ACsDub.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gsxp5mkd0ACsDub.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 checkip.dyndns.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
gsxp5mkd0ACsDub.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 gsxp5mkd0ACsDub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum gsxp5mkd0ACsDub.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
gsxp5mkd0ACsDub.exedescription pid process target process PID 2300 set thread context of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
gsxp5mkd0ACsDub.exedescription pid process Token: SeDebugPrivilege 5028 gsxp5mkd0ACsDub.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
gsxp5mkd0ACsDub.exedescription pid process target process PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe PID 2300 wrote to memory of 5028 2300 gsxp5mkd0ACsDub.exe gsxp5mkd0ACsDub.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gsxp5mkd0ACsDub.exe"C:\Users\Admin\AppData\Local\Temp\gsxp5mkd0ACsDub.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\gsxp5mkd0ACsDub.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gsxp5mkd0ACsDub.exe.logFilesize
1KB
MD5e08f822522c617a40840c62e4b0fb45e
SHA1ae516dca4da5234be6676d3f234c19ec55725be7
SHA256bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
-
memory/2300-130-0x0000000000260000-0x0000000000354000-memory.dmpFilesize
976KB
-
memory/2300-131-0x0000000005240000-0x00000000057E4000-memory.dmpFilesize
5.6MB
-
memory/2300-132-0x0000000004FB0000-0x0000000005042000-memory.dmpFilesize
584KB
-
memory/2300-133-0x0000000005050000-0x000000000505A000-memory.dmpFilesize
40KB
-
memory/2300-134-0x0000000005890000-0x000000000592C000-memory.dmpFilesize
624KB
-
memory/2300-135-0x0000000007690000-0x00000000076F6000-memory.dmpFilesize
408KB
-
memory/5028-137-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/5028-136-0x0000000000000000-mapping.dmp