Analysis
-
max time kernel
59s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe
Resource
win10v2004-20220414-en
General
-
Target
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe
-
Size
579KB
-
MD5
f9061b35c7ed637323aac46c5d15d002
-
SHA1
797b13720bbc9ae30134fb421941e02ba73d7bd4
-
SHA256
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782
-
SHA512
da07e25ae000328dce3ae94e1e8ef7737813767975d400bfceabcc0fb63c75582b274cc07724295e1ff675d9f69c69885946dc276ebd4c8554b4819ce54f2408
Malware Config
Extracted
matiex
Protocol: smtp- Host:
smtp.porkbun.com - Port:
587 - Username:
info@wholesalesltd.xyz - Password:
godisable147
Signatures
-
Matiex Main Payload 11 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp.exe family_matiex C:\Users\Admin\AppData\Local\Temp\tmp.exe family_matiex C:\Users\Admin\AppData\Local\Temp\tmp.exe family_matiex behavioral1/memory/1272-60-0x0000000000D30000-0x0000000000DA0000-memory.dmp family_matiex behavioral1/memory/1160-65-0x0000000000080000-0x00000000000F0000-memory.dmp family_matiex behavioral1/memory/1160-66-0x0000000000080000-0x00000000000F0000-memory.dmp family_matiex behavioral1/memory/1160-68-0x000000000046BADE-mapping.dmp family_matiex behavioral1/memory/1160-71-0x0000000000080000-0x00000000000F0000-memory.dmp family_matiex behavioral1/memory/1160-75-0x0000000000080000-0x00000000000F0000-memory.dmp family_matiex behavioral1/memory/1160-78-0x0000000000080000-0x00000000000F0000-memory.dmp family_matiex behavioral1/memory/1160-70-0x0000000000080000-0x00000000000F0000-memory.dmp family_matiex -
Executes dropped EXE 2 IoCs
Processes:
tmp.exesvhost.exepid process 1272 tmp.exe 1160 svhost.exe -
Loads dropped DLL 3 IoCs
Processes:
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exepid process 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
tmp.exesvhost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tmp.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tmp.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tmp.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svhost.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svhost.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svhost.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 freegeoip.app 14 freegeoip.app 17 freegeoip.app 5 checkip.dyndns.org 6 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exedescription pid process target process PID 988 set thread context of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exepid process 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exetmp.exesvhost.exedescription pid process Token: SeDebugPrivilege 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe Token: SeDebugPrivilege 1272 tmp.exe Token: SeDebugPrivilege 1160 svhost.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.execmd.exedescription pid process target process PID 988 wrote to memory of 1272 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe tmp.exe PID 988 wrote to memory of 1272 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe tmp.exe PID 988 wrote to memory of 1272 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe tmp.exe PID 988 wrote to memory of 1272 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe tmp.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1160 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe svhost.exe PID 988 wrote to memory of 1936 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 1936 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 1936 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 1936 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 360 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 360 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 360 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 360 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 360 wrote to memory of 824 360 cmd.exe reg.exe PID 360 wrote to memory of 824 360 cmd.exe reg.exe PID 360 wrote to memory of 824 360 cmd.exe reg.exe PID 360 wrote to memory of 824 360 cmd.exe reg.exe PID 988 wrote to memory of 1520 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 1520 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 1520 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe PID 988 wrote to memory of 1520 988 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe cmd.exe -
outlook_office_path 1 IoCs
Processes:
svhost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svhost.exe -
outlook_win_path 1 IoCs
Processes:
svhost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe"C:\Users\Admin\AppData\Local\Temp\f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
579KB
MD5f9061b35c7ed637323aac46c5d15d002
SHA1797b13720bbc9ae30134fb421941e02ba73d7bd4
SHA256f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782
SHA512da07e25ae000328dce3ae94e1e8ef7737813767975d400bfceabcc0fb63c75582b274cc07724295e1ff675d9f69c69885946dc276ebd4c8554b4819ce54f2408
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
425KB
MD534e884a790a7ef67f7c61108e2b9a177
SHA16ad5021f86a6d361a9771001a506ff8b8bf1930a
SHA2565f1ce1d8e909e4fc999dd5a1fea71103cff35e075750117c8d9e3ec5045f09f0
SHA51279e5fcd411321f1b09b67cc36a2dbeaf88731bd1ebf41cf53d21ed4d7f476b7193c40c33dcc652d707240ec45818b730732465c2a4a329c8ea7dd4d020aea2e8
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
425KB
MD534e884a790a7ef67f7c61108e2b9a177
SHA16ad5021f86a6d361a9771001a506ff8b8bf1930a
SHA2565f1ce1d8e909e4fc999dd5a1fea71103cff35e075750117c8d9e3ec5045f09f0
SHA51279e5fcd411321f1b09b67cc36a2dbeaf88731bd1ebf41cf53d21ed4d7f476b7193c40c33dcc652d707240ec45818b730732465c2a4a329c8ea7dd4d020aea2e8
-
\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
579KB
MD5f9061b35c7ed637323aac46c5d15d002
SHA1797b13720bbc9ae30134fb421941e02ba73d7bd4
SHA256f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782
SHA512da07e25ae000328dce3ae94e1e8ef7737813767975d400bfceabcc0fb63c75582b274cc07724295e1ff675d9f69c69885946dc276ebd4c8554b4819ce54f2408
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
425KB
MD534e884a790a7ef67f7c61108e2b9a177
SHA16ad5021f86a6d361a9771001a506ff8b8bf1930a
SHA2565f1ce1d8e909e4fc999dd5a1fea71103cff35e075750117c8d9e3ec5045f09f0
SHA51279e5fcd411321f1b09b67cc36a2dbeaf88731bd1ebf41cf53d21ed4d7f476b7193c40c33dcc652d707240ec45818b730732465c2a4a329c8ea7dd4d020aea2e8
-
memory/360-83-0x0000000000000000-mapping.dmp
-
memory/824-84-0x0000000000000000-mapping.dmp
-
memory/988-54-0x0000000000C40000-0x0000000000CD6000-memory.dmpFilesize
600KB
-
memory/988-55-0x0000000076571000-0x0000000076573000-memory.dmpFilesize
8KB
-
memory/1160-68-0x000000000046BADE-mapping.dmp
-
memory/1160-66-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-71-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-75-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-78-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-70-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-65-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-63-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1160-62-0x0000000000080000-0x00000000000F0000-memory.dmpFilesize
448KB
-
memory/1272-60-0x0000000000D30000-0x0000000000DA0000-memory.dmpFilesize
448KB
-
memory/1272-57-0x0000000000000000-mapping.dmp
-
memory/1520-87-0x0000000000000000-mapping.dmp
-
memory/1936-82-0x0000000000000000-mapping.dmp