matiex | 24cb7ddefda210a0ec3e8e4aea6ea96397ae4a55200fc08d2a737272c2c102c3

General

Target

Quote.exe

Score

10^/10

matiex evasion keylogger spyware stealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1379319539:AAFQ7f96r1-8ijh6-Hym9Weh67R1ZdDQt0g/sendMessage?chat_id=1472166686

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2552-13-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex
behavioral2/memory/2552-14-0x000000000047204E-mapping.dmp	family_matiex

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Quote.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Quote.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Quote.exe

Drops startup file 1 IoCs

Processes:

Quote.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Appdata.url Quote.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 checkip.dyndns.org
15 freegeoip.app
16 freegeoip.app

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Appdata.url	Quote.exe

flow	ioc
12	checkip.dyndns.org
15	freegeoip.app
16	freegeoip.app

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Quote.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Quote.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Quote.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Quote.exe

description pid process target process

PID 652 set thread context of 2552 652 Quote.exe Quote.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Quote.exe

pid process

2552 Quote.exe
2552 Quote.exe
2552 Quote.exe
2552 Quote.exe
2552 Quote.exe
2552 Quote.exe
2552 Quote.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Quote.exe

pid process

2552 Quote.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Quote.exeQuote.exe

description pid process

Token: SeDebugPrivilege 652 Quote.exe
Token: SeDebugPrivilege 2552 Quote.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Quote.exe

pid process

2552 Quote.exe

description	pid	process	target process
PID 652 set thread context of 2552	652	Quote.exe	Quote.exe

pid	process
2552	Quote.exe
2552	Quote.exe
2552	Quote.exe
2552	Quote.exe
2552	Quote.exe
2552	Quote.exe
2552	Quote.exe

pid	process
2552	Quote.exe

description	pid	process
Token: SeDebugPrivilege	652	Quote.exe
Token: SeDebugPrivilege	2552	Quote.exe

pid	process
2552	Quote.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Quote.exeQuote.exe

description	pid	process	target process
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 652 wrote to memory of 2552	652	Quote.exe	Quote.exe
PID 2552 wrote to memory of 3836	2552	Quote.exe	netsh.exe
PID 2552 wrote to memory of 3836	2552	Quote.exe	netsh.exe
PID 2552 wrote to memory of 3836	2552	Quote.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Quote.exe
"C:\Users\Admin\AppData\Local\Temp\Quote.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\Quote.exe
"{path}"
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:3836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote.exe.log
MD5
c9aee78d4e775b33bdf129c9ed58dd15

SHA1
4db166792d2eed48476d9e5625ed9938d9269f00

SHA256
4bff531bc0ee0fb02ee5e4fbbdafcf8bea8d5e43ba76dca89962469c191967cd

SHA512
74083d6689f89f1cec61890e7be21a59fd1e78c6e8dd49edaa7093c0a3d623cae2dedd1d55da6335f255c592d220c922f4acf6aa9dd7c346a3dce1545ddc27ff

Download Submit
memory/652-7-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/652-12-0x00000000065F0000-0x00000000065F1000-memory.dmp

Filesize
4KB

Download
memory/652-6-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/652-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/652-8-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/652-9-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/652-5-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/652-11-0x00000000064C0000-0x000000000657B000-memory.dmp

Filesize
748KB

Download
memory/652-10-0x0000000005240000-0x000000000524E000-memory.dmp

Filesize
56KB

Download
memory/652-3-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2552-14-0x000000000047204E-mapping.dmp

Download
memory/2552-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2552-16-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2552-25-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/3836-24-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads