matiex | 793d3532c805e1e2406fa8d9da0c2dc23dae090a2b7c52ba322abbd864e627a8

General

Target

NK974589.exe
Size

342KB
MD5

ec30bc66cef63f29080c284fe9f66583
SHA1

8387b00478606de6cfdd1484fe72dae09c1b4758
SHA256

793d3532c805e1e2406fa8d9da0c2dc23dae090a2b7c52ba322abbd864e627a8
SHA512

b0e3487b7c28732355b6dde78fb3ff6a221dc2bafb4b712329c68c6246fb5b0420b69b14790347940d8a955880781cd2460fc710430902196e97d2cdbe129726

Score

10^/10

matiex keylogger spyware stealer suricata

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2364-116-0x0000000000400000-0x0000000000484000-memory.dmp	family_matiex
behavioral2/memory/2364-117-0x000000000040188B-mapping.dmp	family_matiex
behavioral2/memory/2364-118-0x0000000002400000-0x000000000246F000-memory.dmp	family_matiex
behavioral2/memory/2364-120-0x0000000000400000-0x0000000000484000-memory.dmp	family_matiex

suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram
suricata: ET MALWARE Matiex Keylogger Exfil Via Telegram
suricata
Loads dropped DLL 1 IoCs

Processes:

NK974589.exe

pid process

2124 NK974589.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
7 freegeoip.app
8 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

NK974589.exe

description pid process target process

PID 2124 set thread context of 2364 2124 NK974589.exe NK974589.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

NK974589.exe

pid process

2364 NK974589.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NK974589.exe

description pid process

Token: SeDebugPrivilege 2364 NK974589.exe

pid	process
2124	NK974589.exe

flow	ioc
4	checkip.dyndns.org
7	freegeoip.app
8	freegeoip.app

description	pid	process	target process
PID 2124 set thread context of 2364	2124	NK974589.exe	NK974589.exe

pid	process
2364	NK974589.exe

description	pid	process
Token: SeDebugPrivilege	2364	NK974589.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

NK974589.exeNK974589.exe

description	pid	process	target process
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2124 wrote to memory of 2364	2124	NK974589.exe	NK974589.exe
PID 2364 wrote to memory of 4028	2364	NK974589.exe	netsh.exe
PID 2364 wrote to memory of 4028	2364	NK974589.exe	netsh.exe
PID 2364 wrote to memory of 4028	2364	NK974589.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\NK974589.exe
"C:\Users\Admin\AppData\Local\Temp\NK974589.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Local\Temp\NK974589.exe
"C:\Users\Admin\AppData\Local\Temp\NK974589.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdA82E.tmp\lqwipxz.dll

MD5
148e2440033d4c9c35f68f4072ba5d1e

SHA1
480b6d0a378fa7e785e79de7e0f757dd7e8124e3

SHA256
47094fa8accf250c8df2021a0180140be6f1091415d44e9927e5ed6ba6c60bb4

SHA512
1a272ef57ad29b3481a1f18530168d1af7cc6a20bef32249412e0eadcc7dbd306157c3b8fca971ac21bde9cf7229370124cce29038bd3cc1ef93a03008c0367d

Download Submit
memory/2364-124-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/2364-125-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/2364-118-0x0000000002400000-0x000000000246F000-memory.dmp

Filesize
444KB

Download
memory/2364-121-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/2364-120-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2364-122-0x0000000004B52000-0x0000000004B53000-memory.dmp

Filesize
4KB

Download
memory/2364-117-0x000000000040188B-mapping.dmp

Download
memory/2364-116-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2364-123-0x0000000004B53000-0x0000000004B54000-memory.dmp

Filesize
4KB

Download
memory/2364-126-0x0000000004B54000-0x0000000004B55000-memory.dmp

Filesize
4KB

Download
memory/2364-127-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/2364-131-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/2364-129-0x0000000005C90000-0x0000000005C91000-memory.dmp

Filesize
4KB

Download
memory/2364-130-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/4028-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing