Overview

overview

10

Static

static

payment in...00.exe

windows7_x64

10

payment in...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment invoice090909000.exe

  • Size

    478KB

  • Sample

    201228-8c9nl3k846

  • MD5

    5ce9199ca2f9bbfb99cf5dd672e884af

  • SHA1

    484ce13dc8aed2309c2bbeb25b0136bbe5228114

  • SHA256

    9a14ef7dd61e214e5d8f0ed0e4e98efdf3b6a97794e12e6c74811f85bf0fe021

  • SHA512

    509af31de428567ab35be085259e78b88ddf0627c26baaf7d1c54099b531798815a436638523aae5ace4ea4017634057ff197abc579cc38ceb2841b14250ebfa

Score
10/10
matiexkeyloggerstealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    srvc13.turhost.com
  • Port:
    587
  • Username:
    info@bilgitekdagitim.com
  • Password:
    italik2015

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    srvc13.turhost.com
  • Port:
    587
  • Username:
    info@bilgitekdagitim.com
  • Password:
    italik2015

Targets

    • Target

      payment invoice090909000.exe

    • Size

      478KB

    • MD5

      5ce9199ca2f9bbfb99cf5dd672e884af

    • SHA1

      484ce13dc8aed2309c2bbeb25b0136bbe5228114

    • SHA256

      9a14ef7dd61e214e5d8f0ed0e4e98efdf3b6a97794e12e6c74811f85bf0fe021

    • SHA512

      509af31de428567ab35be085259e78b88ddf0627c26baaf7d1c54099b531798815a436638523aae5ace4ea4017634057ff197abc579cc38ceb2841b14250ebfa

    Score
    10/10
    matiexkeyloggerstealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks