Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.pdf.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Invoice.pdf.scr
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Itemslists.scr
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Itemslists.scr
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Pictures.jpg.scr
Resource
win7-20231129-en
General
-
Target
Itemslists.scr
-
Size
488KB
-
MD5
b95e010955432d3e5a2e63d54c01e1b2
-
SHA1
9a9e7575f960483591ac327e092e1a3fb041208a
-
SHA256
1b68f5ab26d4fd7c7ca1933dd8dcc6f6f879104a072dc92f9d5917ad42a3cfd7
-
SHA512
f2fca4e5ac2469f8a4466520b154bfa3567a8e060dd14e11692ddf904cea86b7b8eee859e2b125e7234dde956d2e89b000fb7ebcb0648720b822ea4624b0a024
-
SSDEEP
12288:+g2Sh8cpTmGuh+6soYYhBHDejsgJEaTOL1p6O5n+vToVe:+gRh8xAkFBHDe7bTIW0Ve
Malware Config
Extracted
matiex
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
coronavirus2020 - Email To:
[email protected]
Signatures
-
Matiex Main payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2156-13-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Itemslists.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Itemslists.scr -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 checkip.dyndns.org 25 freegeoip.app 26 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Itemslists.scrdescription pid process target process PID 2204 set thread context of 2156 2204 Itemslists.scr MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1684 2156 WerFault.exe MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MSBuild.exepid process 2156 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 2156 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Itemslists.scrdescription pid process target process PID 2204 wrote to memory of 2348 2204 Itemslists.scr schtasks.exe PID 2204 wrote to memory of 2348 2204 Itemslists.scr schtasks.exe PID 2204 wrote to memory of 2348 2204 Itemslists.scr schtasks.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe PID 2204 wrote to memory of 2156 2204 Itemslists.scr MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Itemslists.scr"C:\Users\Admin\AppData\Local\Temp\Itemslists.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AxOLPSrlQrex" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD28.tmp"2⤵
- Creates scheduled task(s)
PID:2348 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 19683⤵
- Program crash
PID:1684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2156 -ip 21561⤵PID:800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b67d471b45aa6eaa9bc5d248343afdd4
SHA1fd4a57bd56579fa4c5f831dece24fb4c8ade48a7
SHA256e63bbd52b717b07e79e0352da80847d9491d9674b99afbabfb68cfdc94b78107
SHA5127c4ca5cffa1a813d944e02ceba4813f613db6c7721b93331cd24fa08ae409d505a27752579f0d5672dd4429e4ff85fc6caf5c7034b65196cc418f15496db31ab