Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2023 15:05
Static task
static1
Behavioral task
behavioral1
Sample
007556d5a71f6dd74f0b5a9778cf31ff.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
007556d5a71f6dd74f0b5a9778cf31ff.exe
Resource
win10v2004-20220812-en
General
-
Target
007556d5a71f6dd74f0b5a9778cf31ff.exe
-
Size
476KB
-
MD5
007556d5a71f6dd74f0b5a9778cf31ff
-
SHA1
ada81ef2208703f22b1fe99f7342927bc9640dd6
-
SHA256
e24d753b84d8ca4411b4157a300baea0e41cfdb04e6f0bb437b4273110f89d53
-
SHA512
9cbe5768e5b9c86cc4b8ed7f55122747acbe828ac295831082e793eaa76ab6cf169602a7fa28355ebec6b8722d2abbec634c33d148c93f456fa5a13d317769d2
-
SSDEEP
12288:5js193PQAW630ZwDAiu/7mmtfOD6IybGr2XTd:5bL630ZhZz1tfYTyboM
Malware Config
Extracted
matiex
Protocol: smtp- Host:
srvc13.turhost.com - Port:
587 - Username:
info@bilgitekdagitim.com - Password:
italik2015
Signatures
-
Matiex Main payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2640-134-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 checkip.dyndns.org 11 freegeoip.app 12 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
007556d5a71f6dd74f0b5a9778cf31ff.exedescription pid process target process PID 3044 set thread context of 2640 3044 007556d5a71f6dd74f0b5a9778cf31ff.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3340 2640 WerFault.exe MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
007556d5a71f6dd74f0b5a9778cf31ff.exepid process 3044 007556d5a71f6dd74f0b5a9778cf31ff.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 2640 MSBuild.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
007556d5a71f6dd74f0b5a9778cf31ff.exedescription pid process target process PID 3044 wrote to memory of 2640 3044 007556d5a71f6dd74f0b5a9778cf31ff.exe MSBuild.exe PID 3044 wrote to memory of 2640 3044 007556d5a71f6dd74f0b5a9778cf31ff.exe MSBuild.exe PID 3044 wrote to memory of 2640 3044 007556d5a71f6dd74f0b5a9778cf31ff.exe MSBuild.exe PID 3044 wrote to memory of 2640 3044 007556d5a71f6dd74f0b5a9778cf31ff.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\007556d5a71f6dd74f0b5a9778cf31ff.exe"C:\Users\Admin\AppData\Local\Temp\007556d5a71f6dd74f0b5a9778cf31ff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\007556d5a71f6dd74f0b5a9778cf31ff.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 19963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2640 -ip 26401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2640-132-0x0000000000000000-mapping.dmp
-
memory/2640-134-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/2640-135-0x0000000005710000-0x00000000057AC000-memory.dmpFilesize
624KB
-
memory/2640-136-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/2640-137-0x00000000057B0000-0x0000000005816000-memory.dmpFilesize
408KB
-
memory/3044-133-0x000000000053D000-0x0000000000540000-memory.dmpFilesize
12KB