Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2024 05:18
Static task
static1
Behavioral task
behavioral1
Sample
819096acf63b5d611a3009c559049e27.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
819096acf63b5d611a3009c559049e27.exe
Resource
win10v2004-20231215-en
General
-
Target
819096acf63b5d611a3009c559049e27.exe
-
Size
479KB
-
MD5
819096acf63b5d611a3009c559049e27
-
SHA1
11aab366797c1d758b288002fcf79e38d7401dcb
-
SHA256
597c71c6a2012cf5ccd4a5e8b97be637add1d690283331c709f4c8fee94dd280
-
SHA512
5e2d50c87791d4a05144c2bcdd91f28b2ae464dbf6f23d3d1c04c255312b1b9c685619023c202d96cf7c0e8d432041ab365d4337b45dc6568a0a54dd1ab93b86
-
SSDEEP
6144:QZAFjCBUSf/f45NBQvOdS7965mgZBr7jbFSfMfqhWu4iW4ElEjyWBYa:IEOBWUvO4p6Q+J7vF+MQWT181
Malware Config
Extracted
matiex
https://api.telegram.org/bot1769987238:AAEQYijlXWT1FDvBzphYZ0NJ0B8IOgYjki0/sendMessage?chat_id=1816626867
Signatures
-
Matiex Main payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-3-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 checkip.dyndns.org 16 freegeoip.app 17 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
819096acf63b5d611a3009c559049e27.exedescription pid process target process PID 4864 set thread context of 5028 4864 819096acf63b5d611a3009c559049e27.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4568 5028 WerFault.exe MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
819096acf63b5d611a3009c559049e27.exepid process 4864 819096acf63b5d611a3009c559049e27.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 5028 MSBuild.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
819096acf63b5d611a3009c559049e27.exedescription pid process target process PID 4864 wrote to memory of 5028 4864 819096acf63b5d611a3009c559049e27.exe MSBuild.exe PID 4864 wrote to memory of 5028 4864 819096acf63b5d611a3009c559049e27.exe MSBuild.exe PID 4864 wrote to memory of 5028 4864 819096acf63b5d611a3009c559049e27.exe MSBuild.exe PID 4864 wrote to memory of 5028 4864 819096acf63b5d611a3009c559049e27.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\819096acf63b5d611a3009c559049e27.exe"C:\Users\Admin\AppData\Local\Temp\819096acf63b5d611a3009c559049e27.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\819096acf63b5d611a3009c559049e27.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 20083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5028 -ip 50281⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4864-1-0x0000000000440000-0x0000000000540000-memory.dmpFilesize
1024KB
-
memory/4864-2-0x0000000000980000-0x0000000000984000-memory.dmpFilesize
16KB
-
memory/5028-3-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/5028-4-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB
-
memory/5028-5-0x0000000005470000-0x000000000550C000-memory.dmpFilesize
624KB
-
memory/5028-6-0x0000000005AC0000-0x0000000006064000-memory.dmpFilesize
5.6MB
-
memory/5028-7-0x0000000005580000-0x00000000055E6000-memory.dmpFilesize
408KB
-
memory/5028-8-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/5028-9-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB