matiex | 6fa65eef03e50dbaba9ba7729d7d5f4a24d9302c028ec1640db45d47096ab29d

Analysis

max time kernel
150s
max time network
126s
platform
windows10_x64
resource
win10
submitted
14/10/2020, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0908000009h090000.exe
Size 577KB
Sample201014-k8k6q3vhx6
SHA256 6fa65eef03e50dbaba9ba7729d7d5f4a24d9302c028ec1640db45d47096ab29d
MD5 40f119bd23e3dfe95c416a839da87142
SHA1 164cca839ad92c95b3ccbf75873c8d590ff29c89
SHA512 57b30e1242d22c4445b28762fa0e14577169d1e6863a989f0cea6a6affe01800ca9c0e6820ee0818bddd8cc4de58754986927be8d06badd7187069c0eafe33b1
MD5 SHA1 SHA512

Score

10^/10

matiex keylogger stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
srvc13.turhost.com
Port
587
Username
[email protected]
Password
italik2015

Extracted

Family

matiex

Credentials

Protocol
smtp
Host
srvc13.turhost.com
Port
587
Username
[email protected]
Password
italik2015

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1408-0-0x0000000000620000-0x0000000000692000-memory.dmp	family_matiex
behavioral2/memory/1408-1-0x000000000068DE2E-mapping.dmp	family_matiex

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	checkip.dyndns.org
10	freegeoip.app
11	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 1408	3044	0908000009h090000.exe	77

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1408	MSBuild.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3044	0908000009h090000.exe
3044	0908000009h090000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	MSBuild.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1408	3044	0908000009h090000.exe	77
PID 3044 wrote to memory of 1408	3044	0908000009h090000.exe	77
PID 3044 wrote to memory of 1408	3044	0908000009h090000.exe	77
PID 3044 wrote to memory of 1408	3044	0908000009h090000.exe	77
PID 1408 wrote to memory of 2560	1408	MSBuild.exe	79
PID 1408 wrote to memory of 2560	1408	MSBuild.exe	79
PID 1408 wrote to memory of 2560	1408	MSBuild.exe	79

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-0-0x0000000000620000-0x0000000000692000-memory.dmp

Download

memory/1408-3-0x0000000073470000-0x0000000073B5E000-memory.dmp

Download

memory/1408-6-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/1408-7-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/1408-8-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/1408-10-0x00000000061A0000-0x00000000061A1000-memory.dmp

Download

memory/1408-11-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/1408-12-0x00000000060B0000-0x00000000060B1000-memory.dmp

Download