Analysis
-
max time kernel
31s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 14:04
Static task
static1
Behavioral task
behavioral1
Sample
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe
Resource
win10v2004-20221111-en
General
-
Target
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe
-
Size
704KB
-
MD5
b368b4f8ba0c292896547adf2a35f967
-
SHA1
02db58020730eb1fb7169c3d4ccc6f17aa3b6037
-
SHA256
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5
-
SHA512
0412f02ee3feb86daca01131d7f7fd52037ed6484edd8188c62eeb9c43db7fa6443d5ce9ed3b9c2daba70cadba8d71badecb6dc2670c85b64a6829e80e194d11
-
SSDEEP
12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN
Malware Config
Signatures
-
Matiex Main payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1064-62-0x0000000000400000-0x0000000000482000-memory.dmp family_matiex behavioral1/memory/1064-63-0x0000000000CE0000-0x0000000000D52000-memory.dmp family_matiex -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 checkip.dyndns.org 7 freegeoip.app 8 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exedescription pid process target process PID 1624 set thread context of 1064 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1168 1064 WerFault.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exepid process 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exedescription pid process Token: SeDebugPrivilege 1064 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.execmd.exe2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exedescription pid process target process PID 2008 wrote to memory of 1716 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe cmd.exe PID 2008 wrote to memory of 1716 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe cmd.exe PID 2008 wrote to memory of 1716 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe cmd.exe PID 2008 wrote to memory of 1716 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe cmd.exe PID 2008 wrote to memory of 1368 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 2008 wrote to memory of 1368 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 2008 wrote to memory of 1368 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 2008 wrote to memory of 1368 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1716 wrote to memory of 1328 1716 cmd.exe schtasks.exe PID 1716 wrote to memory of 1328 1716 cmd.exe schtasks.exe PID 1716 wrote to memory of 1328 1716 cmd.exe schtasks.exe PID 1716 wrote to memory of 1328 1716 cmd.exe schtasks.exe PID 2008 wrote to memory of 1624 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 2008 wrote to memory of 1624 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 2008 wrote to memory of 1624 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 2008 wrote to memory of 1624 2008 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1624 wrote to memory of 1064 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1624 wrote to memory of 1064 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1624 wrote to memory of 1064 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1624 wrote to memory of 1064 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1624 wrote to memory of 1064 1624 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe PID 1064 wrote to memory of 1168 1064 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe WerFault.exe PID 1064 wrote to memory of 1168 1064 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe WerFault.exe PID 1064 wrote to memory of 1168 1064 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe WerFault.exe PID 1064 wrote to memory of 1168 1064 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe -
outlook_win_path 1 IoCs
Processes:
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"C:\Users\Admin\AppData\Local\Temp\2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 16804⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xmlFilesize
1KB
MD534f122e2766147a3ece75bc054d744b7
SHA1850b609f2e75e0a677e9e67c3238ae0bdf5f9554
SHA25699a1f874f51f2725643224f5b5263adaa5b27d5318f595b1a697d84f08f7f6ef
SHA512a38867adc0d454577dc663cd9e27ba3111cc8e387024543329a5e5fda2b1b5889cf9e7237370c39afb4329bf43a23a3356186794f47a28df1abec9b2ad9cbee0
-
memory/1064-59-0x000000000040188B-mapping.dmp
-
memory/1064-61-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB
-
memory/1064-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1064-63-0x0000000000CE0000-0x0000000000D52000-memory.dmpFilesize
456KB
-
memory/1168-64-0x0000000000000000-mapping.dmp
-
memory/1328-55-0x0000000000000000-mapping.dmp
-
memory/1624-56-0x0000000000000000-mapping.dmp
-
memory/1624-60-0x000000000036B000-0x0000000000370000-memory.dmpFilesize
20KB
-
memory/1716-54-0x0000000000000000-mapping.dmp
-
memory/2008-57-0x00000000001BA000-0x00000000001C0000-memory.dmpFilesize
24KB