Overview

overview

10

Static

static

PURCHASE O...2).exe

windows7_x64

10

PURCHASE O...2).exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    16-11-2020 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PURCHASE ORDER (2).exe

Score
10/10
matiexkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1446233835:AAFUBfbUnZ7JJIYwfK1VPiEf9YSnzaCuLXc/sendMessage?chat_id=1430605258

Signatures

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex
  • Matiex Main Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER (2).exe
    "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER (2).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER (2).exe
      "{path}"
      2⤵
        PID:3372
      • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER (2).exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Windows\SysWOW64\netsh.exe
          "netsh" wlan show profile
          3⤵
            PID:2684

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER (2).exe.log
        MD5

        3fed8d1dd11972a6e2603bb2d73a3ee5

        SHA1

        7ecb7f64ade7b91c5815da647e84167c3d95afb4

        SHA256

        eecf6c0575dc995a485d46a5daaa66f58229e552f16782d873834d218ab17551

        SHA512

        ca6059eb67f800cc666d5146d24070abf5ee08209f8f9d1668a0ca2201eb3f6fa013c2d807b09925e12b82c37686980fcc26a6a5e4a5ba129c4b2a585961d3bb

        Download Submit
      • memory/556-10-0x0000000000400000-0x0000000000476000-memory.dmp
        Filesize

        472KB

        Download
      • memory/556-22-0x0000000006B10000-0x0000000006B11000-memory.dmp
        Filesize

        4KB

        Download
      • memory/556-18-0x0000000004D90000-0x0000000004D91000-memory.dmp
        Filesize

        4KB

        Download
      • memory/556-13-0x00000000739A0000-0x000000007408E000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/556-11-0x0000000000471AAE-mapping.dmp
        Download
      • memory/796-5-0x00000000052A0000-0x00000000052A1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/796-8-0x0000000007960000-0x00000000079FB000-memory.dmp
        Filesize

        620KB

        Download
      • memory/796-9-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/796-7-0x0000000005570000-0x0000000005584000-memory.dmp
        Filesize

        80KB

        Download
      • memory/796-6-0x0000000007BA0000-0x0000000007BA1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/796-0-0x00000000739A0000-0x000000007408E000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/796-4-0x00000000052F0000-0x00000000052F1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/796-3-0x0000000005710000-0x0000000005711000-memory.dmp
        Filesize

        4KB

        Download
      • memory/796-1-0x00000000009F0000-0x00000000009F1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2684-21-0x0000000000000000-mapping.dmp
        Download