matiex | 8d8c5013933443f1f3e20db22a1abd56815cdd61b866f7953e032678f5e3d049

General

Target

NKP210102-NIT-SC2.exe
Size

897KB
MD5

65b5174a50b047604c2aed66369a4a88
SHA1

853e75392f379c6d9f655c53c881c45287ab2f6b
SHA256

8d8c5013933443f1f3e20db22a1abd56815cdd61b866f7953e032678f5e3d049
SHA512

04e5a3e89538fc8a7b83773f52a9424da327f7fc2709e2f64f977056078e9bee87fc9ebd29619607a63b8844d084f093aa8da7d223eb97154bdb8137312b0d0e

Score

10^/10

Family

matiex

Credentials

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/516-11-0x0000000000400000-0x0000000000474000-memory.dmp	family_matiex
behavioral2/memory/516-12-0x000000000046E60E-mapping.dmp	family_matiex

Drops startup file 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url RegSvcs.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 freegeoip.app
15 checkip.dyndns.org
18 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

NKP210102-NIT-SC2.exe

description pid process target process

PID 4768 set thread context of 516 4768 NKP210102-NIT-SC2.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegSvcs.exe

pid process

516 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

516 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 516 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

516 RegSvcs.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	RegSvcs.exe

description	pid	process	target process
PID 4768 set thread context of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe

pid	process
516	RegSvcs.exe

pid	process
516	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	516	RegSvcs.exe

pid	process
516	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NKP210102-NIT-SC2.exe

description	pid	process	target process
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 4768 wrote to memory of 516	4768	NKP210102-NIT-SC2.exe	RegSvcs.exe

memory/516-11-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/516-20-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/516-18-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/516-13-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/516-12-0x000000000046E60E-mapping.dmp

Download
memory/4768-6-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/4768-9-0x0000000007E30000-0x0000000007EF6000-memory.dmp

Filesize
792KB

Download
memory/4768-10-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/4768-8-0x0000000005CB0000-0x0000000005CBE000-memory.dmp

Filesize
56KB

Download
memory/4768-7-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/4768-2-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/4768-5-0x0000000005D10000-0x0000000005D11000-memory.dmp

Filesize
4KB

Download
memory/4768-3-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download