Overview

overview

10

Static

static

INVOICE RE...34.exe

windows7_x64

1

INVOICE RE...34.exe

windows10_x64

10

Analysis

  • max time kernel
    102s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-07-2021 10:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INVOICE RECEIPT NO253334.exe

  • Size

    455KB

  • MD5

    c6b4a2eb53f687988c0427cf752d429f

  • SHA1

    d6b3299043950047524087631f72375b68bfc36d

  • SHA256

    786a583ea35093cc588069ed3b8d4dd6dbe8e9edfe68569d3752c6da82db0de1

  • SHA512

    ded0daa7672ade2aabf1695c67441c0c488b8f44170ebd438105936eeac2a4d9fb7da1aef48565bb42caf6807eb4f0157a0de43ddf4731e5d3c428e8cf034dee

Score
10/10
matiexkeyloggerstealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1718729558:AAFUftnJNVxfQZ7XrIUEpE1UiXHAYPc6VAQ/sendMessage?chat_id=1841930277

Signatures

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex
  • Matiex Main Payload 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE RECEIPT NO253334.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE RECEIPT NO253334.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\INVOICE RECEIPT NO253334.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:3404

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1032-114-0x000000000047008E-mapping.dmp
      Download
    • memory/1032-116-0x0000000000400000-0x0000000000476000-memory.dmp
      Filesize

      472KB

      Download
    • memory/1032-118-0x0000000005480000-0x0000000005481000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1032-119-0x0000000005A20000-0x0000000005A21000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1032-120-0x0000000005520000-0x0000000005521000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1032-121-0x0000000005410000-0x0000000005411000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1032-123-0x0000000006B40000-0x0000000006B41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1032-124-0x0000000006A30000-0x0000000006A31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1032-125-0x00000000069E0000-0x00000000069E1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3404-122-0x0000000000000000-mapping.dmp
      Download
    • memory/3956-115-0x0000000000740000-0x0000000000742000-memory.dmp
      Filesize

      8KB

      Download