Analysis
- max time kernel
149s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
12/05/2022, 15:48
General
- Target f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe
- Size 579KB
- Sample220512-s9adfaafc9
- SHA256 f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782
Malware Config
Extracted
-
matiex
-
Protocol
smtp
-
Host
smtp.porkbun.com
-
Port
587
-
Username
-
Password
godisable147
Signatures
- Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
- Matiex Main Payload 3 IoCs
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe"C:\Users\Admin\AppData\Local\Temp\f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/f9bf4cfd9b01450f92f9b0e1e329fdf4b31b234f60607b626a258aa6cbf40782.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
name.exe
svhost.exe
svhost.exe
tmp.exe
tmp.exe
memory/4352-130-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/4352-133-0x00000000051E0000-0x0000000005272000-memory.dmp
memory/4352-132-0x0000000005880000-0x0000000005E24000-memory.dmp
memory/4352-131-0x00000000050A0000-0x000000000513C000-memory.dmp
memory/4356-138-0x0000000004C30000-0x0000000004C96000-memory.dmp
memory/4356-137-0x0000000000160000-0x00000000001D0000-memory.dmp
memory/4356-148-0x0000000006350000-0x0000000006512000-memory.dmp
memory/4356-149-0x0000000006210000-0x000000000621A000-memory.dmp