Overview
overview
8Static
static
7MatSploit.rar
windows7-x64
3MatSploit.rar
windows10-2004-x64
3BootsTrapperU.exe
windows7-x64
3BootsTrapperU.exe
windows10-2004-x64
8DiscordRPC.dll
windows7-x64
1DiscordRPC.dll
windows10-2004-x64
1ICSharpCod...it.dll
windows7-x64
1ICSharpCod...it.dll
windows10-2004-x64
1ICSharpCod...it.xml
windows7-x64
1ICSharpCod...it.xml
windows10-2004-x64
1MatSploit.exe
windows7-x64
6MatSploit.exe
windows10-2004-x64
8bin/Bootst...on.txt
windows7-x64
1bin/Bootst...on.txt
windows10-2004-x64
1bin/MatSploit.dll
windows7-x64
8bin/MatSploit.dll
windows10-2004-x64
8bin/UIVersion.txt
windows7-x64
1bin/UIVersion.txt
windows10-2004-x64
1bin/Zeus.exe
windows7-x64
1bin/Zeus.exe
windows10-2004-x64
1bin/lua.xml
windows7-x64
1bin/lua.xml
windows10-2004-x64
1bin/rbxfps...er.exe
windows7-x64
1bin/rbxfps...er.exe
windows10-2004-x64
3bin/version.txt
windows7-x64
1bin/version.txt
windows10-2004-x64
1bin/worksp...29.txt
windows7-x64
1bin/worksp...29.txt
windows10-2004-x64
1librarys/d...pc.dll
windows7-x64
3librarys/d...pc.dll
windows10-2004-x64
3scripts/LT2.js
windows7-x64
1scripts/LT2.js
windows10-2004-x64
1Analysis
-
max time kernel
100s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2023 16:41
Behavioral task
behavioral1
Sample
MatSploit.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MatSploit.rar
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
BootsTrapperU.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
BootsTrapperU.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
DiscordRPC.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
DiscordRPC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
ICSharpCode.AvalonEdit.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral9
Sample
ICSharpCode.AvalonEdit.xml
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
ICSharpCode.AvalonEdit.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
MatSploit.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
MatSploit.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
bin/BootstrapperVersion.txt
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
bin/BootstrapperVersion.txt
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
bin/MatSploit.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
bin/MatSploit.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
bin/UIVersion.txt
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
bin/UIVersion.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
bin/Zeus.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
bin/Zeus.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
bin/lua.xml
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
bin/lua.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
bin/rbxfpsunlocker.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
bin/rbxfpsunlocker.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral25
Sample
bin/version.txt
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
bin/version.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
bin/workspace/286090429.txt
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
bin/workspace/286090429.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
librarys/discordrpc.dll
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
librarys/discordrpc.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
scripts/LT2.js
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
scripts/LT2.js
Resource
win10v2004-20230220-en
General
-
Target
bin/lua.xml
-
Size
3KB
-
MD5
06c3876d77733fb64b8ec472afc77133
-
SHA1
10404820f6f7b1b3eba8be8ed11ce3873cdc1199
-
SHA256
4fe8128712ef9160e233ce05034046e90fba572a75f253853d8c21c8b1207a9c
-
SHA512
f7f76edd231772118152d3d6a3c2b0668adac4055057d5989cc17da9b15f76695a86debfe327ca149819b5478e89cb9f0ce51fd70753e5e4cd2eb4cc0e42a691
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000b1216c8138e91f1d03eb212e3a9b8a6213f587afd8673053710ce6e2f953cb1e000000000e800000000200002000000000cd95c993f4afe95aed61da867315667f5213e91e8f593353d7c0e0fe5f063d2000000093498cff9c512ac1a689d4997d0c2b7fc648dd3f76ec4dd5c81becdf49af849740000000c4ab6241c6aecd78f27080cb7f0b06a6ef5b0605db59a84eb0285d81d92ac2295f52152e24217708a1fd6bb73dada17ae061a4d97c0ac0bfdc21c7f26109a934 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000cf53c4e31108730dd6514f9a63c88b07b352fc09806be27df6c2f62ef3ea2332000000000e8000000002000020000000b86f70374f7b0a295a607c9242f48f9b10082a45f78942f4e9b554365d01fea890000000a8166663ec874f9fcb3a9081566cbce56cd869527829c94600c00badcfe12545d940df6ad8b96f1476118b61edbb3e2a2707533a79dbf45fc9bd051920d3fde8be6d05db3c6e5c375588ca78841d95fa34a22294c6b5387e081cab1f297f2150e1e066c2ee395843641adf5acbfead5fed941ac0c7f2e43a0fcb1727bfc1f955586393b5cecb74a2d1cb6dd053f2995c40000000143786640b17ad5fa0ad8430156f91cf407f0e6f83826397bef23e5c417a807847033ad2c611e0abd9bb5782c18709a5d3fad46dcfb65ef67728cf28b0e26a45 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D5DAFD1-C9A2-11ED-A056-C29C0423A1DF} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386358311" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8018c9e3ae5dd901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1004 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1004 IEXPLORE.EXE 1004 IEXPLORE.EXE 376 IEXPLORE.EXE 376 IEXPLORE.EXE 376 IEXPLORE.EXE 376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1740 wrote to memory of 1040 1740 MSOXMLED.EXE iexplore.exe PID 1740 wrote to memory of 1040 1740 MSOXMLED.EXE iexplore.exe PID 1740 wrote to memory of 1040 1740 MSOXMLED.EXE iexplore.exe PID 1740 wrote to memory of 1040 1740 MSOXMLED.EXE iexplore.exe PID 1040 wrote to memory of 1004 1040 iexplore.exe IEXPLORE.EXE PID 1040 wrote to memory of 1004 1040 iexplore.exe IEXPLORE.EXE PID 1040 wrote to memory of 1004 1040 iexplore.exe IEXPLORE.EXE PID 1040 wrote to memory of 1004 1040 iexplore.exe IEXPLORE.EXE PID 1004 wrote to memory of 376 1004 IEXPLORE.EXE IEXPLORE.EXE PID 1004 wrote to memory of 376 1004 IEXPLORE.EXE IEXPLORE.EXE PID 1004 wrote to memory of 376 1004 IEXPLORE.EXE IEXPLORE.EXE PID 1004 wrote to memory of 376 1004 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\bin\lua.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1004 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Tar78D1.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PWZF06P0.txtFilesize
607B
MD54b797b7c5ea0fe1815dc377f7166a6c5
SHA176b875f8930b79693d9ab57ed275af014146db5a
SHA256468b53c327d7f2b76f647df0b8d61fadadbea2aceefac02bf1e3082309cc6b2f
SHA51223106b810e6f16dd5ea97a5dc4ba769c73d283e62f988defc6d6c74ced96f3c7040b74fd9669c7358fbb90b11376a4766efd20d4b78e07138e9be4ec0cd19c72