Analysis
-
max time kernel
92s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:47
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchase Order.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchase Order.pdf.exe
-
Size
361KB
-
MD5
206f4433e9871eb640d993237c23933e
-
SHA1
c915f546298de42e3f5b7c1eb674dc4d0425df04
-
SHA256
074c065bacbb7880ce7f0d4d2ef0794398bf9152beb9a59d6d7f096b6e94e44d
-
SHA512
49f0cb6eac3be11aea716f7038e31626804734e41cf0ef5cd62e52af6297eba4046501cf01c42f97b2d247c2111f4d962ccc9ada4e1ba52ad8cc932eab7a735a
Malware Config
Extracted
matiex
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
k4kuml@yandex.com - Password:
GOOD123456
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/320-136-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Purchase Order.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation Purchase Order.pdf.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 freegeoip.app 36 freegeoip.app 33 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.pdf.exedescription pid process target process PID 3216 set thread context of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1920 320 WerFault.exe Purchase Order.pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Purchase Order.pdf.exepid process 3216 Purchase Order.pdf.exe 3216 Purchase Order.pdf.exe 3216 Purchase Order.pdf.exe 3216 Purchase Order.pdf.exe 3216 Purchase Order.pdf.exe 3216 Purchase Order.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Purchase Order.pdf.exepid process 320 Purchase Order.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.pdf.exePurchase Order.pdf.exedescription pid process Token: SeDebugPrivilege 3216 Purchase Order.pdf.exe Token: SeDebugPrivilege 320 Purchase Order.pdf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Purchase Order.pdf.exedescription pid process target process PID 3216 wrote to memory of 1560 3216 Purchase Order.pdf.exe schtasks.exe PID 3216 wrote to memory of 1560 3216 Purchase Order.pdf.exe schtasks.exe PID 3216 wrote to memory of 1560 3216 Purchase Order.pdf.exe schtasks.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe PID 3216 wrote to memory of 320 3216 Purchase Order.pdf.exe Purchase Order.pdf.exe -
outlook_office_path 1 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe -
outlook_win_path 1 IoCs
Processes:
Purchase Order.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TluNTUKXvqN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC61F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.pdf.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 20283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 320 -ip 3201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.pdf.exe.logFilesize
412B
MD5ad1c7f6525cfeb54c0487efd38b0e26c
SHA1ed3da94723ac7e3828a9e93d68418bb810592f3b
SHA2560a534a3d0fa82e6a427164c5f6e702cac7e4afc9967af9bc5ddba4f84ab33276
SHA51248d625e6be5391d91d95c2850226fe39bb2411cb72139797699cfe126e6b066182e83950a8ea67e63b64a66b0d45f58d8bc97cab0363d55c2fd88c0d1d28009c
-
C:\Users\Admin\AppData\Local\Temp\tmpC61F.tmpFilesize
1KB
MD570c861ff4023a7efce2ec0ca3ae5d7f3
SHA1bf08dff1c4469d445b393717c7e19fa941745c0b
SHA256bddb27d0357c8708003b35c663fc7a77f17489e1afb5e7db01cce7bd1e44cc96
SHA51239f49dcd6b4d7edf6394714c661ad84893cbc501ee91f0dea35d0888784c5a2e17f15f1701b99ffd3fe8660fd3c9c4bda1f940da02112eb2eb88e3a07fcf43d3
-
memory/320-135-0x0000000000000000-mapping.dmp
-
memory/320-136-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/320-138-0x0000000005710000-0x0000000005CB4000-memory.dmpFilesize
5.6MB
-
memory/320-139-0x00000000050B0000-0x0000000005116000-memory.dmpFilesize
408KB
-
memory/1560-133-0x0000000000000000-mapping.dmp
-
memory/3216-130-0x0000000000200000-0x0000000000260000-memory.dmpFilesize
384KB
-
memory/3216-131-0x0000000004F20000-0x0000000004FBC000-memory.dmpFilesize
624KB
-
memory/3216-132-0x0000000005060000-0x00000000050F2000-memory.dmpFilesize
584KB