matiex | af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7

General

Target

NKP210102-NIT-SC2.exe
Size

779KB
MD5

087dfca6f2b2c9825a49d4b986d7f539
SHA1

748e44b93cf2882248b2e27c728eb11018984bf4
SHA256

af8629a317a5fe7aa5900f445cd855b902a495c497646c3ef1485ea5a9d026a7
SHA512

25ab703c8261e1c36e4656b405b2aff6c8595bc26fe3b0f982e7249a90d6d6405d5f66ff8c28f8696d16c99a479718657dc669e0e4e5c2abe00e3ea03bac588d

Score

10^/10

matiex keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
mail.revistaeducar.com.ar
Port:
25
Username:
smtp-1a2c5@revistaeducar.com.ar
Password:
somchai#3774

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2132-13-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral2/memory/2132-14-0x000000000046DD1E-mapping.dmp	family_matiex

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 checkip.dyndns.org
17 freegeoip.app
18 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

NKP210102-NIT-SC2.exe

description pid process target process

PID 636 set thread context of 2132 636 NKP210102-NIT-SC2.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3368 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegSvcs.exe

pid process

2132 RegSvcs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

2132 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2132 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

2132 RegSvcs.exe

flow	ioc
14	checkip.dyndns.org
17	freegeoip.app
18	freegeoip.app

description	pid	process	target process
PID 636 set thread context of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe

pid	process
3368	schtasks.exe

pid	process
2132	RegSvcs.exe

pid	process
2132	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2132	RegSvcs.exe

pid	process
2132	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

NKP210102-NIT-SC2.exe

description	pid	process	target process
PID 636 wrote to memory of 3368	636	NKP210102-NIT-SC2.exe	schtasks.exe
PID 636 wrote to memory of 3368	636	NKP210102-NIT-SC2.exe	schtasks.exe
PID 636 wrote to memory of 3368	636	NKP210102-NIT-SC2.exe	schtasks.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe
PID 636 wrote to memory of 2132	636	NKP210102-NIT-SC2.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\NKP210102-NIT-SC2.exe
"C:\Users\Admin\AppData\Local\Temp\NKP210102-NIT-SC2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kVTLnkXYUzFB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82E.tmp"
2⤵
- Creates scheduled task(s)
PID:3368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp82E.tmp
MD5
ea60a40ea8b3fa549c85df834489b02a

SHA1
75a7ebfa4e38868aea587d0d44640a8b7ec222d5

SHA256
54df73b02e74372fd4f85cdcfc4a2f463270b3cabff97628f0474e7f01cdc84a

SHA512
ded1cf6870751b6cfd651b388bab3a573a047d341a5857d21cc5e7ef4fdce709d63f8e4941bc53de0d132096a901d599b9a0e1bd7ae1cbed7a26bd9abcd6c9d6

Download Submit
memory/636-6-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/636-3-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/636-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/636-7-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/636-8-0x0000000004A40000-0x0000000004A4E000-memory.dmp

Filesize
56KB

Download
memory/636-9-0x0000000005800000-0x00000000058C1000-memory.dmp

Filesize
772KB

Download
memory/636-10-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/636-5-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/2132-14-0x000000000046DD1E-mapping.dmp

Download
memory/2132-13-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2132-15-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2132-20-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/2132-22-0x0000000006FB0000-0x0000000006FB1000-memory.dmp

Filesize
4KB

Download
memory/3368-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads