Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 19:29
Static task
static1
Behavioral task
behavioral1
Sample
mo908000800j865.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
mo908000800j865.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
mo908000800j865.exe
-
Size
577KB
-
MD5
dfd4dde62f8d8746edc2b7f450259181
-
SHA1
50a0f7a1fa3e7bcd4ded00ae20e35e585d9f7867
-
SHA256
deb96dddc557e467d8e3ac9bf5ee8fc167f74461d84e823925c0f8c7b33422e7
-
SHA512
15646b34619848f38e19959b3dff3c3448eda137e527f58f22babfcf304154831f72626890b955f6ca5934efa78f8d0ee83137ad0cd66e60b9c1c17149162a33
Score
10/10
Malware Config
Extracted
Family
matiex
Credentials
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
[email protected] - Password:
italik2015
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2460-132-0x0000000000400000-0x0000000000472000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 freegeoip.app 12 checkip.dyndns.org 14 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mo908000800j865.exedescription pid process target process PID 4420 set thread context of 2460 4420 mo908000800j865.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2968 2460 WerFault.exe MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
mo908000800j865.exepid process 4420 mo908000800j865.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 2460 MSBuild.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
mo908000800j865.exedescription pid process target process PID 4420 wrote to memory of 2460 4420 mo908000800j865.exe MSBuild.exe PID 4420 wrote to memory of 2460 4420 mo908000800j865.exe MSBuild.exe PID 4420 wrote to memory of 2460 4420 mo908000800j865.exe MSBuild.exe PID 4420 wrote to memory of 2460 4420 mo908000800j865.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mo908000800j865.exe"C:\Users\Admin\AppData\Local\Temp\mo908000800j865.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 19923⤵
- Program crash
PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2460 -ip 24601⤵PID:4612