Analysis
-
max time kernel
38s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-01-2023 07:53
Behavioral task
behavioral1
Sample
c6f80a699274d3334e79528a0b490a4b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c6f80a699274d3334e79528a0b490a4b.exe
Resource
win10v2004-20220812-en
General
-
Target
c6f80a699274d3334e79528a0b490a4b.exe
-
Size
456KB
-
MD5
c6f80a699274d3334e79528a0b490a4b
-
SHA1
3b7f71bd66e0d40282c9b9115c2c7c8632918dbd
-
SHA256
91700fbcb5e9f728358d7b5fd2125bd9afa72ccf31b4cf4731090feda90868a3
-
SHA512
c871dd4c6df108ef90576468fca010a4242267699f45d35f3559248159f95ff98c3ee309dfa509789212a7fd359784e707ab2eea66735f2aab62311f9c145422
-
SSDEEP
3072:cospLgw9EjmJQjB/ESqyS80CEZuK7+SPtqhI7MxMRZ0aTNMY:cXL9Ejmuj9ESFhg+S8IAsZ0ah
Malware Config
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Signatures
-
Matiex Main payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-54-0x00000000008B0000-0x0000000000922000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
c6f80a699274d3334e79528a0b490a4b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c6f80a699274d3334e79528a0b490a4b.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c6f80a699274d3334e79528a0b490a4b.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c6f80a699274d3334e79528a0b490a4b.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 checkip.dyndns.org 7 freegeoip.app 8 freegeoip.app -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1808 1644 WerFault.exe c6f80a699274d3334e79528a0b490a4b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c6f80a699274d3334e79528a0b490a4b.exedescription pid process Token: SeDebugPrivilege 1644 c6f80a699274d3334e79528a0b490a4b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c6f80a699274d3334e79528a0b490a4b.exedescription pid process target process PID 1644 wrote to memory of 1808 1644 c6f80a699274d3334e79528a0b490a4b.exe WerFault.exe PID 1644 wrote to memory of 1808 1644 c6f80a699274d3334e79528a0b490a4b.exe WerFault.exe PID 1644 wrote to memory of 1808 1644 c6f80a699274d3334e79528a0b490a4b.exe WerFault.exe PID 1644 wrote to memory of 1808 1644 c6f80a699274d3334e79528a0b490a4b.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
c6f80a699274d3334e79528a0b490a4b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c6f80a699274d3334e79528a0b490a4b.exe -
outlook_win_path 1 IoCs
Processes:
c6f80a699274d3334e79528a0b490a4b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c6f80a699274d3334e79528a0b490a4b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6f80a699274d3334e79528a0b490a4b.exe"C:\Users\Admin\AppData\Local\Temp\c6f80a699274d3334e79528a0b490a4b.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 17922⤵
- Program crash