Analysis
-
max time kernel
94s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:47
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchase Order.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchase Order.pdf.exe
-
Size
361KB
-
MD5
206f4433e9871eb640d993237c23933e
-
SHA1
c915f546298de42e3f5b7c1eb674dc4d0425df04
-
SHA256
074c065bacbb7880ce7f0d4d2ef0794398bf9152beb9a59d6d7f096b6e94e44d
-
SHA512
49f0cb6eac3be11aea716f7038e31626804734e41cf0ef5cd62e52af6297eba4046501cf01c42f97b2d247c2111f4d962ccc9ada4e1ba52ad8cc932eab7a735a
Malware Config
Extracted
matiex
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
k4kuml@yandex.com - Password:
GOOD123456
Signatures
-
Matiex Main Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-63-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1724-64-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1724-66-0x000000000046E4EE-mapping.dmp family_matiex behavioral1/memory/1724-65-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1724-68-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/1724-70-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 freegeoip.app 9 freegeoip.app 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.pdf.exedescription pid process target process PID 908 set thread context of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2028 1724 WerFault.exe Purchase Order.pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Purchase Order.pdf.exepid process 908 Purchase Order.pdf.exe 908 Purchase Order.pdf.exe 908 Purchase Order.pdf.exe 908 Purchase Order.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Purchase Order.pdf.exepid process 1724 Purchase Order.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.pdf.exePurchase Order.pdf.exedescription pid process Token: SeDebugPrivilege 908 Purchase Order.pdf.exe Token: SeDebugPrivilege 1724 Purchase Order.pdf.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Purchase Order.pdf.exePurchase Order.pdf.exedescription pid process target process PID 908 wrote to memory of 1136 908 Purchase Order.pdf.exe schtasks.exe PID 908 wrote to memory of 1136 908 Purchase Order.pdf.exe schtasks.exe PID 908 wrote to memory of 1136 908 Purchase Order.pdf.exe schtasks.exe PID 908 wrote to memory of 1136 908 Purchase Order.pdf.exe schtasks.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 908 wrote to memory of 1724 908 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 1724 wrote to memory of 2028 1724 Purchase Order.pdf.exe WerFault.exe PID 1724 wrote to memory of 2028 1724 Purchase Order.pdf.exe WerFault.exe PID 1724 wrote to memory of 2028 1724 Purchase Order.pdf.exe WerFault.exe PID 1724 wrote to memory of 2028 1724 Purchase Order.pdf.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe -
outlook_win_path 1 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TluNTUKXvqN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F35.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 17803⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1F35.tmpFilesize
1KB
MD519661c9ea01fd29bab87e0a6a7f27186
SHA10d3973eff8d7179f1385ba7fb6f602e9445b7fd1
SHA256f14dbf082547df45703107dd78e9a6e8a10f8fdd57ab7e64fd3425852d26cdd4
SHA512cdf475ebc1f209350e4a1bf52be4762e3786e2bbbcf62ac5259d5d927585e2a656660296af3cb6ad5a2a490c75a1be556cf3d3df2f802fbb95db8971bf638130
-
memory/908-54-0x00000000010E0000-0x0000000001140000-memory.dmpFilesize
384KB
-
memory/908-55-0x00000000003C0000-0x00000000003CA000-memory.dmpFilesize
40KB
-
memory/908-56-0x0000000000F00000-0x0000000000F54000-memory.dmpFilesize
336KB
-
memory/908-57-0x0000000005690000-0x0000000005702000-memory.dmpFilesize
456KB
-
memory/1136-58-0x0000000000000000-mapping.dmp
-
memory/1724-63-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-61-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-60-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-64-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-66-0x000000000046E4EE-mapping.dmp
-
memory/1724-65-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-68-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-70-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1724-71-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/2028-72-0x0000000000000000-mapping.dmp