Analysis
-
max time kernel
44s -
max time network
92s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-08-2022 18:53
Behavioral task
behavioral1
Sample
260b0475cb253fdbfe7fcca5da72d654.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
260b0475cb253fdbfe7fcca5da72d654.exe
Resource
win10v2004-20220812-en
General
-
Target
260b0475cb253fdbfe7fcca5da72d654.exe
-
Size
445KB
-
MD5
260b0475cb253fdbfe7fcca5da72d654
-
SHA1
bab9a8096fd77be62e46fbd3d19322798dbf0b2c
-
SHA256
acd5409f9d010cd52931d76e42923387c6e34ca855b5878e13c16a1c2fa99e27
-
SHA512
2521e6e3c0d541d412d7a4f5d233c6a7604969fd17f7f2cc32de9ce4236a8539681aa1d505d7363547a5a9edf44e6b6b7b8101307d02ea7d9e19c3adea48dc15
-
SSDEEP
3072:3owRomXjZLHAJh2DxkUhyvc7kq80CEZ/hs+LZMfKVsvMBOXpWNFCP:vOQBHuU9kfvc7kp+VMKVqsOXpk8
Malware Config
Extracted
matiex
https://api.telegram.org/bot1756187234:AAEwfPYzakHSD2qBn9cgXWrQVwhYmkqQScY/sendMessage?chat_id=1704325017
Signatures
-
Matiex Main payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1108-54-0x00000000010B0000-0x0000000001126000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
260b0475cb253fdbfe7fcca5da72d654.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 260b0475cb253fdbfe7fcca5da72d654.exe Key opened \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 260b0475cb253fdbfe7fcca5da72d654.exe Key opened \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 260b0475cb253fdbfe7fcca5da72d654.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 checkip.dyndns.org 7 freegeoip.app 8 freegeoip.app -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 588 1108 WerFault.exe 260b0475cb253fdbfe7fcca5da72d654.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
260b0475cb253fdbfe7fcca5da72d654.exedescription pid process Token: SeDebugPrivilege 1108 260b0475cb253fdbfe7fcca5da72d654.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
260b0475cb253fdbfe7fcca5da72d654.exedescription pid process target process PID 1108 wrote to memory of 588 1108 260b0475cb253fdbfe7fcca5da72d654.exe WerFault.exe PID 1108 wrote to memory of 588 1108 260b0475cb253fdbfe7fcca5da72d654.exe WerFault.exe PID 1108 wrote to memory of 588 1108 260b0475cb253fdbfe7fcca5da72d654.exe WerFault.exe PID 1108 wrote to memory of 588 1108 260b0475cb253fdbfe7fcca5da72d654.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
260b0475cb253fdbfe7fcca5da72d654.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 260b0475cb253fdbfe7fcca5da72d654.exe -
outlook_win_path 1 IoCs
Processes:
260b0475cb253fdbfe7fcca5da72d654.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 260b0475cb253fdbfe7fcca5da72d654.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\260b0475cb253fdbfe7fcca5da72d654.exe"C:\Users\Admin\AppData\Local\Temp\260b0475cb253fdbfe7fcca5da72d654.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 18922⤵
- Program crash