Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 23:19
Static task
static1
Behavioral task
behavioral1
Sample
54dc35ab78394f31963d2f0bd30a6b7b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
54dc35ab78394f31963d2f0bd30a6b7b.exe
Resource
win10v2004-20231215-en
General
-
Target
54dc35ab78394f31963d2f0bd30a6b7b.exe
-
Size
656KB
-
MD5
54dc35ab78394f31963d2f0bd30a6b7b
-
SHA1
4904138a54baf5cb440933e502ff6e8cb6b00829
-
SHA256
ec45a354ba2c7cba3c064325f968d62cdb3999122b76080dd145cc49f13bf7e7
-
SHA512
c54d2abf270dd31eb9e3bf44762803f3d1e4d41a6ea43fd37003a64983fddbac5545a5dafe15b3224aadb7f25037c8dc8818480210a30ef6ed69fef326895d7b
-
SSDEEP
12288:lrf0P3HD5Y2fxOZAcLlQuhntyyFgF1/OV0b4R7wZSEleGxCRfdbBKqS/XWsHFsdn:2P3H1Y2f4HLVnILvOV0b4R7ASEleGmft
Malware Config
Extracted
matiex
https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783
Signatures
-
Matiex Main payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4432-2-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 checkip.dyndns.org 42 freegeoip.app 43 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
54dc35ab78394f31963d2f0bd30a6b7b.exedescription pid process target process PID 4316 set thread context of 4432 4316 54dc35ab78394f31963d2f0bd30a6b7b.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3316 4432 WerFault.exe MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
54dc35ab78394f31963d2f0bd30a6b7b.exepid process 4316 54dc35ab78394f31963d2f0bd30a6b7b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4432 MSBuild.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
54dc35ab78394f31963d2f0bd30a6b7b.exedescription pid process target process PID 4316 wrote to memory of 4432 4316 54dc35ab78394f31963d2f0bd30a6b7b.exe MSBuild.exe PID 4316 wrote to memory of 4432 4316 54dc35ab78394f31963d2f0bd30a6b7b.exe MSBuild.exe PID 4316 wrote to memory of 4432 4316 54dc35ab78394f31963d2f0bd30a6b7b.exe MSBuild.exe PID 4316 wrote to memory of 4432 4316 54dc35ab78394f31963d2f0bd30a6b7b.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54dc35ab78394f31963d2f0bd30a6b7b.exe"C:\Users\Admin\AppData\Local\Temp\54dc35ab78394f31963d2f0bd30a6b7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\54dc35ab78394f31963d2f0bd30a6b7b.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 26003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4432 -ip 44321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4316-0-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4316-1-0x00000000006D0000-0x00000000006D2000-memory.dmpFilesize
8KB
-
memory/4316-3-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4432-2-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4432-4-0x00000000746B0000-0x0000000074E60000-memory.dmpFilesize
7.7MB
-
memory/4432-5-0x0000000004F90000-0x000000000502C000-memory.dmpFilesize
624KB
-
memory/4432-6-0x0000000005040000-0x00000000050A6000-memory.dmpFilesize
408KB
-
memory/4432-7-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4432-8-0x00000000065B0000-0x0000000006B54000-memory.dmpFilesize
5.6MB
-
memory/4432-9-0x00000000746B0000-0x0000000074E60000-memory.dmpFilesize
7.7MB
-
memory/4432-10-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4432-11-0x00000000746B0000-0x0000000074E60000-memory.dmpFilesize
7.7MB