General
-
Target
matrixui.exe
-
Size
7.6MB
-
Sample
241213-mbzmsavngy
-
MD5
bc10f1dccff3104c49b44ecd33a83060
-
SHA1
035b77d91991225c62b91df78d6a81ac0db00ef2
-
SHA256
306eb9163f6be5ef3d65a11086c4b45e931dcedcef6bb86fa20af66d21204a19
-
SHA512
362af99f65c3f72df8d7a131e37d848ccf8c48fabe7f434c81481d9b260f736160624a15e3973c1512a9a7edf10b7d438feffa89bcc81e7f834533f95749c0d5
-
SSDEEP
196608:6YD+kdpzwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWF:R5nAIHL7HmBYXrYSaUNL
Behavioral task
behavioral1
Sample
matrixui.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
matrixui.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
����=.pyc
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
����=.pyc
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
matrixui.exe
-
Size
7.6MB
-
MD5
bc10f1dccff3104c49b44ecd33a83060
-
SHA1
035b77d91991225c62b91df78d6a81ac0db00ef2
-
SHA256
306eb9163f6be5ef3d65a11086c4b45e931dcedcef6bb86fa20af66d21204a19
-
SHA512
362af99f65c3f72df8d7a131e37d848ccf8c48fabe7f434c81481d9b260f736160624a15e3973c1512a9a7edf10b7d438feffa89bcc81e7f834533f95749c0d5
-
SSDEEP
196608:6YD+kdpzwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWF:R5nAIHL7HmBYXrYSaUNL
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
-
-
Target
����=.pyc
-
Size
1KB
-
MD5
e2d11a771e8c5451464b9817b6868f14
-
SHA1
2031f75a15ee41395c377de9bd1613912e7fd307
-
SHA256
42bfd19340aaf6d651af5cf5c35d91634f362c5fd136b5c6b9450b598dcaba28
-
SHA512
44ff514572f8fe72e3c5864d2ee49effdf78febb1504d4131eec775c6208aebbe9af2e9825ebce9a4b527642ccade190be9899023189c599a232afaf8cca2d75
Score1/10 -
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3