Overview

overview

10

Static

static

10

loader.exe

windows7-x64

7

loader.exe

windows10-2004-x64

8

mapper/map.exe

windows7-x64

1

mapper/map.exe

windows10-2004-x64

1

mapper/mat...er.sys

windows10-2004-x64

1

matcha.exe

windows7-x64

1

matcha.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    matcha-version-b7eebc919e96477a.zip

  • Size

    18.3MB

  • Sample

    241110-e31edsyqfs

  • MD5

    c3300222aa84a4e1d37946e95e6d3017

  • SHA1

    c777c09abc7b6b51a7b35185ff1e15afde719577

  • SHA256

    0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2

  • SHA512

    08feb3ca784cda55c4b2991c657e9d98b64594fa9f4acfc62541db5c0aeb7ddee65836438a372734ff1b21290a00cc50dd224f95688c36a3d2c5f9fab6cc1d59

  • SSDEEP

    393216:J8g/BmHdfUM1f/5PaV743SRFUgmNy3z7CiXFvFiKEyJpmuZdsOC:J86mHdr5Gj/mNyD7CiJgKbmu9C

Score
10/10
blankgrabbercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupxvmprotect

Malware Config

Targets

    • Target

      loader.exe

    • Size

      6.8MB

    • MD5

      778d19faa6797d8b17178812eb873638

    • SHA1

      de7c7c2ff3be333a7ee22e7c1cf544a33c3e50a6

    • SHA256

      46e84b940d02fd62aec006e80b56b52e5cddc86c28e16d959b4837d8b1e1f883

    • SHA512

      db8a06e04c2642c2c5cceddb0adb8c0d131b7867b68bcc5a7625f7cdf74bcdaa298d1bf6f83d341255439eee3d1fbd4edd1a7cc6508f3929e1d44d34783b5d61

    • SSDEEP

      98304:CgkwN+MdA5wqMr4o8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoaZDJ1n6hBnLq:CgV1gB6ylnlPzf+JiJCsmFMvNn6hVv+

    Score
    8/10
    upxcollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      mapper/map.exe

    • Size

      5.2MB

    • MD5

      91b2e38c78a29587e4bc141c3f048f0e

    • SHA1

      720a32e02fb3e9529c193c4cc1874a74c7548146

    • SHA256

      02ac7fcef95d3d8ba108c85311412739ec680dcc84e0e6baee6a77aa2271ecff

    • SHA512

      f5b256a0544df654e793634a847892fe00ee412bef33bc4011e7f9d6d215ccbaf0d39270dcd832e403e95ddf109d1f643bff68e359c545837c6c17e1d9f248f8

    • SSDEEP

      98304:MjqhOJCjRLRWUEjzqRxOdlWb0T8hEjE+R7WFxjQFQ/WbzZC+x2wAP:MesJCjR13EavA8+8+j1RSxjQsWXZul

    Score
    1/10
    behavioral3behavioral4

    • Target

      mapper/matcha-driver.sys

    • Size

      9KB

    • MD5

      21e0a2d7d9ab804eeb1d7c71b532a681

    • SHA1

      2c09d54d71dfbee2eb537844078d74361e1e1dcc

    • SHA256

      5d8f2239e861694d3f10884260160259393d56810e8cc3e6cabae4c0d077c905

    • SHA512

      bfd6b8f3641750bcce137111b895ad9df33d712cb7f0465d99156accdff6298715a9da5da4003e2ad2bad7867013e9be096c21733946c686b2788a679059bc08

    • SSDEEP

      96:xnICc5aHL+i40EzLGenSP+VSHWj7TEGMlOD+1WNBbEpDDIy:JXL+iyzLXSGVYcHg1Wvbon

    Score
    1/10
    behavioral5

    • Target

      matcha.exe

    • Size

      7.0MB

    • MD5

      cce7696bf39f612b48afe51ec7f8735b

    • SHA1

      7187d3d9e272044774e2624a50a3285eca82073a

    • SHA256

      b2e7dab0b5ec3e9210e16b51c640267b4de205991e8027bee7a82e0e48413776

    • SHA512

      41a43d6134a566840e7a95ddf0a3f9d9f4dc2d4276730121598c1ec3237cf67fc457b4aa1f82b5bfa4245acef52bdad0fe6ecc0a9f30a2dd4efbc7b8cf7247ae

    • SSDEEP

      98304:yhWoRlQjtdA7nBPKB/u8aXwSk99gtgZjwWnqQSMJ5UuJ7n+zGJoTL14nYSytUm6O:y9lQj7AFI99+GjwalrpIcSL2YSyL6/i

    Score
    1/10
    behavioral6behavioral7

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

System Information Discovery

3
T1082

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks