e379bcb7b5b2e75b2bb54b8fec093dc0e026d226a822a2b72b2593f7c6fad37f

General

Target

MatSploit/MatSploit.exe
Size

2.5MB
MD5

d00ac2e7d8e9b6ba3188803477ba7bc7
SHA1

1ac71ddd70867836969f3b65d40f3d2c8e5619be
SHA256

0d8822260ec449eaa05b664913e9722d93da48806ef1d22601bd7ba588083359
SHA512

63c230239cc6838f99207a794b3b0346f245d8b021751acf8635ecd8c44fd4884bc3c1810c26bacf808b41d91ee3380925d94cc6b5c4b5d8d27d62ab23884368
SSDEEP

49152:0r03f94DlM5D83gzEHGtReCMVBrbTK7Y/n3cFT+VP+5KO9OQiUZ8o5:C03fuDSo3gzEHGjduNyYEZ+Kv99OA

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	MatSploit.exe

Executes dropped EXE 1 IoCs

pid	Process
4916	MatSploit.exe

Loads dropped DLL 2 IoCs

pid	Process
4916	MatSploit.exe
4916	MatSploit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1864	BootsTrapperU.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	MatSploit.exe
Token: SeDebugPrivilege	1864	BootsTrapperU.exe
Token: SeDebugPrivilege	4916	MatSploit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1864	2456	MatSploit.exe	85
PID 2456 wrote to memory of 1864	2456	MatSploit.exe	85
PID 2456 wrote to memory of 1864	2456	MatSploit.exe	85
PID 1864 wrote to memory of 4916	1864	BootsTrapperU.exe	87
PID 1864 wrote to memory of 4916	1864	BootsTrapperU.exe	87
PID 1864 wrote to memory of 4916	1864	BootsTrapperU.exe	87

C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe
"C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\MatSploit\BootsTrapperU.exe
  "C:\Users\Admin\AppData\Local\Temp\MatSploit\BootsTrapperU.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe
    "C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MatSploit.exe.log

Filesize
2KB

MD5
77286aa8e027d30b1610dd617532ddaf

SHA1
c8bf11c902059f84ab508e7a91ea0746a2b6e8d0

SHA256
7f2f30bb146a9d0acd547843838f1d29519802d4159407fee29d8688b60e9113

SHA512
bf021798abfdf20468e791b07953a4b9768fc3d0678f0efbdcfbfa0a3bb54d24e5272eb5cbc6e1d60c60eac09d437df8390e7417a1edda6b83e8430796ab440d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MatSploit\ICSharpCode.AvalonEdit.dll

Filesize
604KB

MD5
85525afb01eafb7cd53e171344de4653

SHA1
65e4609b6e1d9d0de5568049687edd84fda6d2d3

SHA256
b5180b33e6bb8f215d69d91a6fab46e2e633b222095bcfcafba2530beb181eab

SHA512
3b30b7b4b32ab72ac0903e2053613bf0cd33c8f54879ca012dee12b319aa598e84329e59fc0edb19ad2b4ba6b6d25c12c88cbb78f655e3e6d6396ce909b10799

Download Submit
C:\Users\Admin\AppData\Local\Temp\MatSploit\ICSharpCode.AvalonEdit.dll

Filesize
604KB

MD5
85525afb01eafb7cd53e171344de4653

SHA1
65e4609b6e1d9d0de5568049687edd84fda6d2d3

SHA256
b5180b33e6bb8f215d69d91a6fab46e2e633b222095bcfcafba2530beb181eab

SHA512
3b30b7b4b32ab72ac0903e2053613bf0cd33c8f54879ca012dee12b319aa598e84329e59fc0edb19ad2b4ba6b6d25c12c88cbb78f655e3e6d6396ce909b10799

Download Submit
C:\Users\Admin\AppData\Local\Temp\MatSploit\ICSharpCode.AvalonEdit.dll

Filesize
604KB

MD5
85525afb01eafb7cd53e171344de4653

SHA1
65e4609b6e1d9d0de5568049687edd84fda6d2d3

SHA256
b5180b33e6bb8f215d69d91a6fab46e2e633b222095bcfcafba2530beb181eab

SHA512
3b30b7b4b32ab72ac0903e2053613bf0cd33c8f54879ca012dee12b319aa598e84329e59fc0edb19ad2b4ba6b6d25c12c88cbb78f655e3e6d6396ce909b10799

Download Submit
C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe

Filesize
2.5MB

MD5
dcb25045813cf70b014e3b94f61fb1dd

SHA1
05677911206e6dcde403a6232f1dcb9f77abf959

SHA256
366b2611923ce8255940aafc03c3c156f35b6d0dabe4c5b728233ac0d6c51822

SHA512
23e14f7b2f45c8dddc64cd6d301b144748ac3599139c0ad518d2f75d648c746d80e02334cdc7b014f3efe09844a4d3809e7f3177e623a89033d8de948c12b2ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe

Filesize
2.5MB

MD5
dcb25045813cf70b014e3b94f61fb1dd

SHA1
05677911206e6dcde403a6232f1dcb9f77abf959

SHA256
366b2611923ce8255940aafc03c3c156f35b6d0dabe4c5b728233ac0d6c51822

SHA512
23e14f7b2f45c8dddc64cd6d301b144748ac3599139c0ad518d2f75d648c746d80e02334cdc7b014f3efe09844a4d3809e7f3177e623a89033d8de948c12b2ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\MatSploit\MatSploit.exe

Filesize
2.5MB

MD5
dcb25045813cf70b014e3b94f61fb1dd

SHA1
05677911206e6dcde403a6232f1dcb9f77abf959

SHA256
366b2611923ce8255940aafc03c3c156f35b6d0dabe4c5b728233ac0d6c51822

SHA512
23e14f7b2f45c8dddc64cd6d301b144748ac3599139c0ad518d2f75d648c746d80e02334cdc7b014f3efe09844a4d3809e7f3177e623a89033d8de948c12b2ce

Download Submit
memory/1864-145-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/1864-153-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/1864-144-0x0000000000F10000-0x0000000000F42000-memory.dmp

Filesize
200KB

Download
memory/1864-154-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/1864-146-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/2456-134-0x00000000054A0000-0x0000000005A44000-memory.dmp

Filesize
5.6MB

Download
memory/2456-135-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Filesize
584KB

Download
memory/2456-133-0x0000000000190000-0x000000000041A000-memory.dmp

Filesize
2.5MB

Download
memory/2456-141-0x0000000005440000-0x000000000544E000-memory.dmp

Filesize
56KB

Download
memory/2456-140-0x000000000C180000-0x000000000C1B8000-memory.dmp

Filesize
224KB

Download
memory/2456-137-0x0000000009B90000-0x0000000009C2E000-memory.dmp

Filesize
632KB

Download
memory/2456-142-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/2456-139-0x000000000BEA0000-0x000000000BEA8000-memory.dmp

Filesize
32KB

Download
memory/2456-136-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4916-172-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4916-171-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4916-170-0x0000000000C10000-0x0000000000E9A000-memory.dmp

Filesize
2.5MB

Download
memory/4916-184-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4916-185-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4916-186-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4916-187-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing