Overview

overview

10

Static

static

Required O...99.exe

windows7_x64

10

Required O...99.exe

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    24-07-2021 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Required Order Details 0099299.exe

  • Size

    1.1MB

  • MD5

    3bcae8c41a076a0803c99fea75f2aa87

  • SHA1

    f2c1b01afcc3a3af6d947b39419bb4531daa8945

  • SHA256

    42ff1648e53d0054bc7c4a5c8a5db648c2a3405415d441c7d5801e52f56bf7a7

  • SHA512

    220880b1422811db1d9cd79030ea8005a7921ecabb580a3ed537d68bb068005f98b14a87e1f90f796d0d506ccd37675c9153a84e2ea0096bc45d55534f5e4113

Score
10/10
matiexkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    mail.thts.vn
  • Port:
    25
  • Username:
    sales01@mtlvn.com.vn
  • Password:
    123luongngan1989

Signatures

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex
  • Matiex Main Payload 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Required Order Details 0099299.exe
    "C:\Users\Admin\AppData\Local\Temp\Required Order Details 0099299.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\Required Order Details 0099299.exe
      "C:\Users\Admin\AppData\Local\Temp\Required Order Details 0099299.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1816
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/432-66-0x0000000000400000-0x0000000000472000-memory.dmp
    Filesize

    456KB

    Download
  • memory/432-67-0x000000000046D95E-mapping.dmp
    Download
  • memory/432-68-0x0000000000400000-0x0000000000472000-memory.dmp
    Filesize

    456KB

    Download
  • memory/432-70-0x00000000006A0000-0x00000000006A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1712-71-0x0000000000000000-mapping.dmp
    Download
  • memory/1712-72-0x00000000007E0000-0x0000000000840000-memory.dmp
    Filesize

    384KB

    Download
  • memory/1724-60-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1724-62-0x0000000000570000-0x0000000000571000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1724-63-0x0000000000370000-0x000000000039D000-memory.dmp
    Filesize

    180KB

    Download
  • memory/1724-64-0x0000000005E50000-0x0000000005ED7000-memory.dmp
    Filesize

    540KB

    Download
  • memory/1724-65-0x0000000008DE0000-0x0000000008E53000-memory.dmp
    Filesize

    460KB

    Download