matiex | 5a973c144d49d4ca870852219ed8de091cd22359160c82f00c1c5868ab0b124f

General

Target

2fe0d9dfd0fbaa96190944e7476165e9.exe
Size

491KB
MD5

2fe0d9dfd0fbaa96190944e7476165e9
SHA1

4d19923e1648170f22388b60d5b2eee85e894136
SHA256

5a973c144d49d4ca870852219ed8de091cd22359160c82f00c1c5868ab0b124f
SHA512

d8c21aa9aca37bf20a3785c8ae675756b51061da9864950cc6ed2c942619e975802415940d94592c1de1ab6c13cee0fe82702ed547343620c7ce03b8c7fd9a2e

Score

10^/10

matiex keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
mail.salujaford.in
Port:
587
Username:
[email protected]
Password:
saluja@#$chd

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/576-64-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/576-65-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/576-67-0x00000000004709CE-mapping.dmp	family_matiex
behavioral1/memory/576-66-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/576-68-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

2fe0d9dfd0fbaa96190944e7476165e9.exe

description pid process target process

PID 1432 set thread context of 576 1432 2fe0d9dfd0fbaa96190944e7476165e9.exe 2fe0d9dfd0fbaa96190944e7476165e9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2fe0d9dfd0fbaa96190944e7476165e9.exe

pid process

576 2fe0d9dfd0fbaa96190944e7476165e9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2fe0d9dfd0fbaa96190944e7476165e9.exe

description pid process

Token: SeDebugPrivilege 576 2fe0d9dfd0fbaa96190944e7476165e9.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

description	pid	process	target process
PID 1432 set thread context of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe

pid	process
756	schtasks.exe

pid	process
576	2fe0d9dfd0fbaa96190944e7476165e9.exe

description	pid	process
Token: SeDebugPrivilege	576	2fe0d9dfd0fbaa96190944e7476165e9.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

2fe0d9dfd0fbaa96190944e7476165e9.exe

description	pid	process	target process
PID 1432 wrote to memory of 756	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	schtasks.exe
PID 1432 wrote to memory of 756	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	schtasks.exe
PID 1432 wrote to memory of 756	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	schtasks.exe
PID 1432 wrote to memory of 756	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	schtasks.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe
PID 1432 wrote to memory of 576	1432	2fe0d9dfd0fbaa96190944e7476165e9.exe	2fe0d9dfd0fbaa96190944e7476165e9.exe

C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe
"C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogCLil" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5F0.tmp"
2⤵
- Creates scheduled task(s)
PID:756

C:\Users\Admin\AppData\Local\Temp\2fe0d9dfd0fbaa96190944e7476165e9.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA5F0.tmp
MD5
b51eb9fdc51032bb3bb412db19c174f7

SHA1
c1a9a6c81ff8cce3692b1dcc7cfc86bcfb8f7979

SHA256
988adbcb7e4e0231fca62ed93d5cac958553797d8c57ed32542e7c3d5307b0b6

SHA512
0d4bbeca9808a70288d4e3366b96a34e4a2f5e983e9898222c276c4cbdf33de25eb240306a17553d4790882ada5f8a1d79edb02efff85aecc9359086edd54795

Download Submit
memory/576-64-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/576-67-0x00000000004709CE-mapping.dmp

Download
memory/576-70-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/576-68-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/576-66-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/576-65-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/576-62-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/576-63-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/756-60-0x0000000000000000-mapping.dmp

Download
memory/1432-54-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1432-56-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1432-57-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/1432-59-0x0000000007EF0000-0x0000000007F9C000-memory.dmp

Filesize
688KB

Download
memory/1432-58-0x00000000005B0000-0x00000000005C6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads