Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 19:30
Static task
static1
Behavioral task
behavioral1
Sample
54632e7d37d3142474baff846284247d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
54632e7d37d3142474baff846284247d.exe
Resource
win10v2004-20231222-en
General
-
Target
54632e7d37d3142474baff846284247d.exe
-
Size
812KB
-
MD5
54632e7d37d3142474baff846284247d
-
SHA1
dfd39606a2dce9ffe5887f494d2cba0ee3c8bd22
-
SHA256
dbe6359af1e119c871d0811f321e2ee4044eaf6ec65c68623937d096c197fe8c
-
SHA512
0679ef0eb7b973cef0ebb94bc4e8b0eaf2e5a9ef587b4c54fe81dc984d762bda60266ba83da24bbd5cf9f42110f78b7850e3e4a5cdec8c88037734bf5ccd95ee
-
SSDEEP
12288:2Pp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXMpJXfXUy/Wj:2Dpjtacljjy4OyJC+Ah+yFQzHm2G
Malware Config
Extracted
matiex
Protocol: smtp- Host:
mail.thts.vn - Port:
25 - Username:
[email protected] - Password:
123luongngan1989 - Email To:
[email protected]
Signatures
-
Matiex Main payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-13-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/2704-21-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/2704-19-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/2704-17-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/2704-14-0x0000000000400000-0x0000000000474000-memory.dmp family_matiex behavioral1/memory/2704-28-0x00000000059E0000-0x0000000005A20000-memory.dmp family_matiex -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
54632e7d37d3142474baff846284247d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 54632e7d37d3142474baff846284247d.exe Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 54632e7d37d3142474baff846284247d.exe Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 54632e7d37d3142474baff846284247d.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 freegeoip.app 9 freegeoip.app 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
54632e7d37d3142474baff846284247d.exedescription pid process target process PID 2956 set thread context of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2752 2704 WerFault.exe 54632e7d37d3142474baff846284247d.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
54632e7d37d3142474baff846284247d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C 54632e7d37d3142474baff846284247d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 54632e7d37d3142474baff846284247d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 54632e7d37d3142474baff846284247d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 54632e7d37d3142474baff846284247d.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
54632e7d37d3142474baff846284247d.exepid process 2704 54632e7d37d3142474baff846284247d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
54632e7d37d3142474baff846284247d.exe54632e7d37d3142474baff846284247d.exedescription pid process Token: SeDebugPrivilege 2956 54632e7d37d3142474baff846284247d.exe Token: SeDebugPrivilege 2704 54632e7d37d3142474baff846284247d.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
54632e7d37d3142474baff846284247d.exe54632e7d37d3142474baff846284247d.exedescription pid process target process PID 2956 wrote to memory of 2692 2956 54632e7d37d3142474baff846284247d.exe schtasks.exe PID 2956 wrote to memory of 2692 2956 54632e7d37d3142474baff846284247d.exe schtasks.exe PID 2956 wrote to memory of 2692 2956 54632e7d37d3142474baff846284247d.exe schtasks.exe PID 2956 wrote to memory of 2692 2956 54632e7d37d3142474baff846284247d.exe schtasks.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2956 wrote to memory of 2704 2956 54632e7d37d3142474baff846284247d.exe 54632e7d37d3142474baff846284247d.exe PID 2704 wrote to memory of 2752 2704 54632e7d37d3142474baff846284247d.exe WerFault.exe PID 2704 wrote to memory of 2752 2704 54632e7d37d3142474baff846284247d.exe WerFault.exe PID 2704 wrote to memory of 2752 2704 54632e7d37d3142474baff846284247d.exe WerFault.exe PID 2704 wrote to memory of 2752 2704 54632e7d37d3142474baff846284247d.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
54632e7d37d3142474baff846284247d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 54632e7d37d3142474baff846284247d.exe -
outlook_win_path 1 IoCs
Processes:
54632e7d37d3142474baff846284247d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 54632e7d37d3142474baff846284247d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BOZtQE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84C9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 12443⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp84C9.tmpFilesize
1KB
MD58b023b9beee9ff35973e5572cc6e4cfc
SHA1f3e5758dc53b116e5eca792b3dc3fbf66ce4a2a5
SHA25615a4d0430c66ce152377a8db078563459f49d1ac07e5bd1f0c43231269a0eafa
SHA512ef4bac70cff6b749cd14441961d05690bb86feb214010c89444f9534664597483bb111a1cba2e2ae4ed5ff0ca0c47a7b24c08b8c05f073f50bbfd8303825db5a
-
memory/2704-23-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB
-
memory/2704-19-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-13-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-21-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-28-0x00000000059E0000-0x0000000005A20000-memory.dmpFilesize
256KB
-
memory/2704-27-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB
-
memory/2704-14-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2704-11-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-12-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-17-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2704-24-0x00000000059E0000-0x0000000005A20000-memory.dmpFilesize
256KB
-
memory/2956-7-0x0000000005FF0000-0x00000000060A2000-memory.dmpFilesize
712KB
-
memory/2956-4-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB
-
memory/2956-0-0x0000000001240000-0x0000000001312000-memory.dmpFilesize
840KB
-
memory/2956-5-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/2956-3-0x00000000004A0000-0x00000000004A8000-memory.dmpFilesize
32KB
-
memory/2956-1-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB
-
memory/2956-2-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/2956-6-0x0000000008040000-0x00000000080FC000-memory.dmpFilesize
752KB
-
memory/2956-22-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB