matiex | 0dc02738b4f4ff0ec647c5db409d884b67275abae3f3373931e03aff4d15c705

General

Target

n545687654589b87656n9.exe
Size

290KB
MD5

fe8171a07860b995e5b676df7af4917f
SHA1

05143b3155f467d7d2c859199edc1f3b5fba86d1
SHA256

0dc02738b4f4ff0ec647c5db409d884b67275abae3f3373931e03aff4d15c705
SHA512

0de21298f5d678d5f9217961cff78f7e627e7d8f291f303c7f9c74c6c6d63affc6b9f1ea225254feae954fdbe7fb0b559047b76e05b8dcc48aa886a9b0881392

Score

10^/10

matiex keylogger stealer suricata

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3048-117-0x0000000000780000-0x00000000007F6000-memory.dmp	family_matiex

suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram
suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram
suricata
Loads dropped DLL 1 IoCs

Processes:

n545687654589b87656n9.exe

pid process

2664 n545687654589b87656n9.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 freegeoip.app
8 freegeoip.app
5 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

n545687654589b87656n9.exe

description pid process target process

PID 2664 set thread context of 3048 2664 n545687654589b87656n9.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

3048 MSBuild.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

n545687654589b87656n9.exe

pid process

2664 n545687654589b87656n9.exe
2664 n545687654589b87656n9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3048 MSBuild.exe

pid	process
2664	n545687654589b87656n9.exe

flow	ioc
7	freegeoip.app
8	freegeoip.app
5	checkip.dyndns.org

description	pid	process	target process
PID 2664 set thread context of 3048	2664	n545687654589b87656n9.exe	MSBuild.exe

pid	process
3048	MSBuild.exe

pid	process
2664	n545687654589b87656n9.exe
2664	n545687654589b87656n9.exe

description	pid	process
Token: SeDebugPrivilege	3048	MSBuild.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

n545687654589b87656n9.exeMSBuild.exe

description	pid	process	target process
PID 2664 wrote to memory of 3048	2664	n545687654589b87656n9.exe	MSBuild.exe
PID 2664 wrote to memory of 3048	2664	n545687654589b87656n9.exe	MSBuild.exe
PID 2664 wrote to memory of 3048	2664	n545687654589b87656n9.exe	MSBuild.exe
PID 2664 wrote to memory of 3048	2664	n545687654589b87656n9.exe	MSBuild.exe
PID 3048 wrote to memory of 1220	3048	MSBuild.exe	netsh.exe
PID 3048 wrote to memory of 1220	3048	MSBuild.exe	netsh.exe
PID 3048 wrote to memory of 1220	3048	MSBuild.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\n545687654589b87656n9.exe
"C:\Users\Admin\AppData\Local\Temp\n545687654589b87656n9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\n545687654589b87656n9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso9D41.tmp\klcujdql.dll

MD5
b3240436d759e9f58d7f816e829ccbac

SHA1
02e1bdaa5837d4277379267be51c187d2d048e88

SHA256
a106156b225c27f6b32889001ef1e6bdf70f6c4c3ba74ba1f7a08b23571cd291

SHA512
37185bb32cf5336b9648496da0ca3c1a91002a491b71ddbc67a2942ac1a31ba517a6fdbcd4a2ce2522387568b57987fd9ca692c6114a7881a5d7d3153e8f54a0

Download Submit
memory/1220-123-0x0000000000000000-mapping.dmp

Download
memory/3048-116-0x00000000007F014E-mapping.dmp

Download
memory/3048-117-0x0000000000780000-0x00000000007F6000-memory.dmp

Filesize
472KB

Download
memory/3048-119-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/3048-120-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3048-121-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3048-122-0x0000000006120000-0x0000000006121000-memory.dmp

Filesize
4KB

Download
memory/3048-124-0x0000000006620000-0x0000000006621000-memory.dmp

Filesize
4KB

Download
memory/3048-125-0x0000000005E30000-0x0000000005E31000-memory.dmp

Filesize
4KB

Download
memory/3048-126-0x0000000005DD0000-0x0000000005DD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing