matiex | 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c

General

Target

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Size

391KB
MD5

cff383a9c4716e6ce935e3b4132cef34
SHA1

95fb309753bdb273b8da6cfef6bd7af012d7d11f
SHA256

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c
SHA512

2dd9e08b8539b0bb27bd4a295accb8c48fc22ca34798df23058ee4bc86249b79efecf2b65cd30f71ddb3bd2bb068038163e4302b69bed7160f905897f9c5432d

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1769394961:AAF5BB35akL859CwVaXypIqpVsGWlaKvi7A/sendMessage?chat_id=1735544933

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2760-116-0x0000000000400000-0x0000000000484000-memory.dmp	family_matiex
behavioral1/memory/2760-117-0x000000000040188B-mapping.dmp	family_matiex
behavioral1/memory/2760-118-0x0000000000400000-0x0000000000484000-memory.dmp	family_matiex
behavioral1/memory/2760-119-0x00000000024B0000-0x000000000251F000-memory.dmp	family_matiex

Loads dropped DLL 1 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

pid process

3044 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 freegeoip.app
19 freegeoip.app
16 checkip.dyndns.org

flow	ioc
18	freegeoip.app
19	freegeoip.app
16	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description	pid	process	target process
PID 3044 set thread context of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

pid process

2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description pid process

Token: SeDebugPrivilege 2760 32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

pid	process
2760	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description	pid	process
Token: SeDebugPrivilege	2760	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description	pid	process	target process
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 3044 wrote to memory of 2760	3044	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
PID 2760 wrote to memory of 3648	2760	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	netsh.exe
PID 2760 wrote to memory of 3648	2760	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	netsh.exe
PID 2760 wrote to memory of 3648	2760	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

outlook_win_path 1 IoCs

Processes:

32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe

C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
"C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe
"C:\Users\Admin\AppData\Local\Temp\32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2760

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdCB31.tmp\rdhfmntmn.dll
MD5
f8dcfcb741cfb789c8ac705cb7f69d81

SHA1
bc0b5eea603016766c1e4d03ed8a9c758fb01652

SHA256
10d18893a9d787122213566203de198c54274f8c63825065812378d364d3620a

SHA512
5bc9a735e1dddbee74ac3cee43ecf4f469b2108966b2f914e474c7fa3205498900f2cb761f10eae45cfa9fa20bee500e223a8633f210914de23a0af6b385118d

Download Submit
memory/2760-124-0x0000000004B13000-0x0000000004B14000-memory.dmp

Filesize
4KB

Download
memory/2760-125-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/2760-118-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2760-119-0x00000000024B0000-0x000000000251F000-memory.dmp

Filesize
444KB

Download
memory/2760-121-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/2760-123-0x0000000004B12000-0x0000000004B13000-memory.dmp

Filesize
4KB

Download
memory/2760-117-0x000000000040188B-mapping.dmp

Download
memory/2760-116-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2760-122-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/2760-126-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/2760-127-0x0000000004B14000-0x0000000004B15000-memory.dmp

Filesize
4KB

Download
memory/2760-131-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/2760-129-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/2760-130-0x0000000005F10000-0x0000000005F11000-memory.dmp

Filesize
4KB

Download
memory/3648-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads