matiex | b190c0b66428b594f7507ae98fcc45e1907cb9cdf618919002791241ae94280f

General

Target

tmp/vbc.exe
Size

1.4MB
MD5

3668f9be040098859e662ba94616cc51
SHA1

3b3ec4ac86c462747a2190c33ca2a4588fcc9310
SHA256

b190c0b66428b594f7507ae98fcc45e1907cb9cdf618919002791241ae94280f
SHA512

54fa8de69114af4fc8ccfa5ef11a82587d3b74b5fa80e6e8d1683e5ce997db5d6ffc1b133ebcf97c226c2aad928696198392faaf184486685f0aa2a048a43dd3

Score

10^/10

matiex keylogger stealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1769394961:AAF5BB35akL859CwVaXypIqpVsGWlaKvi7A/sendMessage?chat_id=1735544933

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1152-64-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/1152-65-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/1152-66-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/1152-67-0x000000000047032E-mapping.dmp	family_matiex

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 1676 set thread context of 1152 1676 vbc.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

864 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

vbc.exepowershell.exe

pid process

1676 vbc.exe
1676 vbc.exe
376 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1676 vbc.exe
Token: SeDebugPrivilege 376 powershell.exe

description	pid	process	target process
PID 1676 set thread context of 1152	1676	vbc.exe	vbc.exe

pid	process
864	schtasks.exe

pid	process
1676	vbc.exe
1676	vbc.exe
376	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1676	vbc.exe
Token: SeDebugPrivilege	376	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

vbc.exevbc.exe

description	pid	process	target process
PID 1676 wrote to memory of 376	1676	vbc.exe	powershell.exe
PID 1676 wrote to memory of 376	1676	vbc.exe	powershell.exe
PID 1676 wrote to memory of 376	1676	vbc.exe	powershell.exe
PID 1676 wrote to memory of 376	1676	vbc.exe	powershell.exe
PID 1676 wrote to memory of 864	1676	vbc.exe	schtasks.exe
PID 1676 wrote to memory of 864	1676	vbc.exe	schtasks.exe
PID 1676 wrote to memory of 864	1676	vbc.exe	schtasks.exe
PID 1676 wrote to memory of 864	1676	vbc.exe	schtasks.exe
PID 1676 wrote to memory of 960	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 960	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 960	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 960	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1676 wrote to memory of 1152	1676	vbc.exe	vbc.exe
PID 1152 wrote to memory of 788	1152	vbc.exe	dw20.exe
PID 1152 wrote to memory of 788	1152	vbc.exe	dw20.exe
PID 1152 wrote to memory of 788	1152	vbc.exe	dw20.exe
PID 1152 wrote to memory of 788	1152	vbc.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SOEtXbQzHDdq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SOEtXbQzHDdq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD098.tmp"
2⤵
- Creates scheduled task(s)
PID:864

C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"
2⤵
PID:960

C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 392
3⤵
PID:788

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD098.tmp
MD5
1c20c402328236b8f537f03941a5c5ee

SHA1
bbba074825084206786d9e8445d2af3b95f11fbe

SHA256
358405d244c4cba7911bd0af159936038dab857ca2ea47d344af319e13aec157

SHA512
62cf55dc21d6a9965c0d890fa1b3eb12a37a470bdaeb634ad11562f9bfa0cfa5b8699acfaceded8bd048e4ec3becd6a13ca5e639868a5f6c79ca41935487488a

Download Submit
memory/376-73-0x0000000002481000-0x0000000002482000-memory.dmp

Filesize
4KB

Download
memory/376-58-0x0000000000000000-mapping.dmp

Download
memory/376-74-0x0000000002482000-0x0000000002484000-memory.dmp

Filesize
8KB

Download
memory/376-72-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/788-69-0x0000000000000000-mapping.dmp

Download
memory/788-75-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/864-59-0x0000000000000000-mapping.dmp

Download
memory/1152-64-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1152-65-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1152-66-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1152-67-0x000000000047032E-mapping.dmp

Download
memory/1152-63-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1152-71-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/1152-62-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1676-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1676-57-0x00000000001D1000-0x00000000001D2000-memory.dmp

Filesize
4KB

Download
memory/1676-56-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads