Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe
Resource
win10v2004-20221111-en
General
-
Target
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe
-
Size
228KB
-
MD5
39ae8017537cd6b2a2be5de1da59b838
-
SHA1
1453686f021b58daf86257b5e321e174fed0682f
-
SHA256
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5
-
SHA512
08996813d63c7a5782793e7dfafbb589c9ec492a2dc6c606472050da995d793be136bc0e24e1a8760d9091a07fd168ec28509fb8cf038a4742a2263157e81092
-
SSDEEP
3072:TlwPtV5FKCjZ5fLyRal/79WMiNzaLp63UVlcrb:ed0ClsUhLiNz0Ck
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mate.exemate.exepid process 1476 mate.exe 320 mate.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 652 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exepid process 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mate.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{433C55CB-F3A6-6D58-0132-2074AA20781B} = "C:\\Users\\Admin\\AppData\\Roaming\\Umyq\\mate.exe" mate.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\Currentversion\Run mate.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exemate.exedescription pid process target process PID 1396 set thread context of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1476 set thread context of 320 1476 mate.exe mate.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
mate.exepid process 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe 320 mate.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exedescription pid process Token: SeSecurityPrivilege 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exemate.exepid process 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 1476 mate.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exemate.exemate.exedescription pid process target process PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 1396 wrote to memory of 904 1396 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe PID 904 wrote to memory of 1476 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe mate.exe PID 904 wrote to memory of 1476 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe mate.exe PID 904 wrote to memory of 1476 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe mate.exe PID 904 wrote to memory of 1476 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 1476 wrote to memory of 320 1476 mate.exe mate.exe PID 320 wrote to memory of 1132 320 mate.exe taskhost.exe PID 320 wrote to memory of 1132 320 mate.exe taskhost.exe PID 320 wrote to memory of 1132 320 mate.exe taskhost.exe PID 904 wrote to memory of 652 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe cmd.exe PID 904 wrote to memory of 652 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe cmd.exe PID 904 wrote to memory of 652 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe cmd.exe PID 904 wrote to memory of 652 904 630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe cmd.exe PID 320 wrote to memory of 1132 320 mate.exe taskhost.exe PID 320 wrote to memory of 1132 320 mate.exe taskhost.exe PID 320 wrote to memory of 1232 320 mate.exe Dwm.exe PID 320 wrote to memory of 1232 320 mate.exe Dwm.exe PID 320 wrote to memory of 1232 320 mate.exe Dwm.exe PID 320 wrote to memory of 1232 320 mate.exe Dwm.exe PID 320 wrote to memory of 1232 320 mate.exe Dwm.exe PID 320 wrote to memory of 1304 320 mate.exe Explorer.EXE PID 320 wrote to memory of 1304 320 mate.exe Explorer.EXE PID 320 wrote to memory of 1304 320 mate.exe Explorer.EXE PID 320 wrote to memory of 1304 320 mate.exe Explorer.EXE PID 320 wrote to memory of 1304 320 mate.exe Explorer.EXE PID 320 wrote to memory of 652 320 mate.exe cmd.exe PID 320 wrote to memory of 652 320 mate.exe cmd.exe PID 320 wrote to memory of 652 320 mate.exe cmd.exe PID 320 wrote to memory of 1968 320 mate.exe DllHost.exe PID 320 wrote to memory of 1968 320 mate.exe DllHost.exe PID 320 wrote to memory of 1968 320 mate.exe DllHost.exe PID 320 wrote to memory of 1968 320 mate.exe DllHost.exe PID 320 wrote to memory of 1968 320 mate.exe DllHost.exe PID 320 wrote to memory of 1904 320 mate.exe DllHost.exe PID 320 wrote to memory of 1904 320 mate.exe DllHost.exe PID 320 wrote to memory of 1904 320 mate.exe DllHost.exe PID 320 wrote to memory of 1904 320 mate.exe DllHost.exe PID 320 wrote to memory of 1904 320 mate.exe DllHost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1232
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe"C:\Users\Admin\AppData\Local\Temp\630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe"C:\Users\Admin\AppData\Local\Temp\630c886c75f4f3507c3d786b42d042900f82cf3bb5c9137aff32cbd0657740d5.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Roaming\Umyq\mate.exe"C:\Users\Admin\AppData\Roaming\Umyq\mate.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Roaming\Umyq\mate.exe"C:\Users\Admin\AppData\Roaming\Umyq\mate.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp78a7a29c.bat"4⤵
- Deletes itself
PID:652
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1968
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp78a7a29c.batFilesize
307B
MD55be787c1d9f0fe660016cc8b17e0b08f
SHA1e906100a3394a1f3db6ee3d7d77d35a6ffdac3be
SHA2568493514d7704004ff3b8935d717d8ee5a63fa7ef508496a06121711fb144744f
SHA51221bef479145cbca7bbbb4a76b30cc0c5c746ace9e63602f2bb03382a0eefc2b0b933eaa5cea00e0cc549bbd17f52008b35c02b01c9e8ea4eb023420b4865232c
-
C:\Users\Admin\AppData\Roaming\Umyq\mate.exeFilesize
228KB
MD59e2f9fcb81c9144da0868751f816b2d7
SHA116348f8c233e5b1a714dfa8378b623e49111938e
SHA256810c5846c8ab17248d64e356a3a347dc9d71eab71f7eb8f4a17116779603fd43
SHA512f35c84b234d346429b238f2d599101916fff597c502cbe807e5e81d6c17b8626f3a26afe395a130f2c751ba0b0dbfeda4e1fcb7fc19c71a4d5dc6b128dff5256
-
C:\Users\Admin\AppData\Roaming\Umyq\mate.exeFilesize
228KB
MD59e2f9fcb81c9144da0868751f816b2d7
SHA116348f8c233e5b1a714dfa8378b623e49111938e
SHA256810c5846c8ab17248d64e356a3a347dc9d71eab71f7eb8f4a17116779603fd43
SHA512f35c84b234d346429b238f2d599101916fff597c502cbe807e5e81d6c17b8626f3a26afe395a130f2c751ba0b0dbfeda4e1fcb7fc19c71a4d5dc6b128dff5256
-
C:\Users\Admin\AppData\Roaming\Umyq\mate.exeFilesize
228KB
MD59e2f9fcb81c9144da0868751f816b2d7
SHA116348f8c233e5b1a714dfa8378b623e49111938e
SHA256810c5846c8ab17248d64e356a3a347dc9d71eab71f7eb8f4a17116779603fd43
SHA512f35c84b234d346429b238f2d599101916fff597c502cbe807e5e81d6c17b8626f3a26afe395a130f2c751ba0b0dbfeda4e1fcb7fc19c71a4d5dc6b128dff5256
-
\Users\Admin\AppData\Roaming\Umyq\mate.exeFilesize
228KB
MD59e2f9fcb81c9144da0868751f816b2d7
SHA116348f8c233e5b1a714dfa8378b623e49111938e
SHA256810c5846c8ab17248d64e356a3a347dc9d71eab71f7eb8f4a17116779603fd43
SHA512f35c84b234d346429b238f2d599101916fff597c502cbe807e5e81d6c17b8626f3a26afe395a130f2c751ba0b0dbfeda4e1fcb7fc19c71a4d5dc6b128dff5256
-
\Users\Admin\AppData\Roaming\Umyq\mate.exeFilesize
228KB
MD59e2f9fcb81c9144da0868751f816b2d7
SHA116348f8c233e5b1a714dfa8378b623e49111938e
SHA256810c5846c8ab17248d64e356a3a347dc9d71eab71f7eb8f4a17116779603fd43
SHA512f35c84b234d346429b238f2d599101916fff597c502cbe807e5e81d6c17b8626f3a26afe395a130f2c751ba0b0dbfeda4e1fcb7fc19c71a4d5dc6b128dff5256
-
memory/320-72-0x0000000000413048-mapping.dmp
-
memory/320-114-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/320-97-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/652-99-0x0000000000080000-0x00000000000A7000-memory.dmpFilesize
156KB
-
memory/652-81-0x0000000000000000-mapping.dmp
-
memory/904-62-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/904-61-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/904-60-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/904-57-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/904-58-0x0000000000413048-mapping.dmp
-
memory/904-83-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1132-76-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/1132-80-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/1132-79-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/1132-78-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/1132-82-0x00000000003E0000-0x0000000000407000-memory.dmpFilesize
156KB
-
memory/1232-86-0x0000000000340000-0x0000000000367000-memory.dmpFilesize
156KB
-
memory/1232-87-0x0000000000340000-0x0000000000367000-memory.dmpFilesize
156KB
-
memory/1232-88-0x0000000000340000-0x0000000000367000-memory.dmpFilesize
156KB
-
memory/1232-89-0x0000000000340000-0x0000000000367000-memory.dmpFilesize
156KB
-
memory/1304-95-0x0000000002AD0000-0x0000000002AF7000-memory.dmpFilesize
156KB
-
memory/1304-94-0x0000000002AD0000-0x0000000002AF7000-memory.dmpFilesize
156KB
-
memory/1304-93-0x0000000002AD0000-0x0000000002AF7000-memory.dmpFilesize
156KB
-
memory/1304-92-0x0000000002AD0000-0x0000000002AF7000-memory.dmpFilesize
156KB
-
memory/1396-56-0x0000000000587000-0x0000000000589000-memory.dmpFilesize
8KB
-
memory/1476-69-0x0000000000517000-0x0000000000519000-memory.dmpFilesize
8KB
-
memory/1476-65-0x0000000000000000-mapping.dmp
-
memory/1904-110-0x00000000027F0000-0x0000000002817000-memory.dmpFilesize
156KB
-
memory/1904-111-0x00000000027F0000-0x0000000002817000-memory.dmpFilesize
156KB
-
memory/1904-112-0x00000000027F0000-0x0000000002817000-memory.dmpFilesize
156KB
-
memory/1904-113-0x00000000027F0000-0x0000000002817000-memory.dmpFilesize
156KB
-
memory/1968-106-0x00000000003C0000-0x00000000003E7000-memory.dmpFilesize
156KB
-
memory/1968-107-0x00000000003C0000-0x00000000003E7000-memory.dmpFilesize
156KB
-
memory/1968-105-0x00000000003C0000-0x00000000003E7000-memory.dmpFilesize
156KB
-
memory/1968-104-0x00000000003C0000-0x00000000003E7000-memory.dmpFilesize
156KB