matiex | b190c0b66428b594f7507ae98fcc45e1907cb9cdf618919002791241ae94280f

General

Target

tmp/vbc.exe
Size

1.4MB
MD5

3668f9be040098859e662ba94616cc51
SHA1

3b3ec4ac86c462747a2190c33ca2a4588fcc9310
SHA256

b190c0b66428b594f7507ae98fcc45e1907cb9cdf618919002791241ae94280f
SHA512

54fa8de69114af4fc8ccfa5ef11a82587d3b74b5fa80e6e8d1683e5ce997db5d6ffc1b133ebcf97c226c2aad928696198392faaf184486685f0aa2a048a43dd3

Score

10^/10

matiex keylogger stealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1769394961:AAF5BB35akL859CwVaXypIqpVsGWlaKvi7A/sendMessage?chat_id=1735544933

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1224-122-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral2/memory/1224-123-0x000000000047032E-mapping.dmp	family_matiex

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 3576 set thread context of 1224 3576 vbc.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1424 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exedw20.exe

pid process

904 powershell.exe
1736 dw20.exe
1736 dw20.exe
904 powershell.exe
904 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exedw20.exe

description pid process

Token: SeDebugPrivilege 904 powershell.exe
Token: SeRestorePrivilege 1736 dw20.exe
Token: SeBackupPrivilege 1736 dw20.exe

description	pid	process	target process
PID 3576 set thread context of 1224	3576	vbc.exe	vbc.exe

pid	process
1424	schtasks.exe

pid	process
904	powershell.exe
1736	dw20.exe
1736	dw20.exe
904	powershell.exe
904	powershell.exe

description	pid	process
Token: SeDebugPrivilege	904	powershell.exe
Token: SeRestorePrivilege	1736	dw20.exe
Token: SeBackupPrivilege	1736	dw20.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

vbc.exevbc.exe

description	pid	process	target process
PID 3576 wrote to memory of 904	3576	vbc.exe	powershell.exe
PID 3576 wrote to memory of 904	3576	vbc.exe	powershell.exe
PID 3576 wrote to memory of 904	3576	vbc.exe	powershell.exe
PID 3576 wrote to memory of 1424	3576	vbc.exe	schtasks.exe
PID 3576 wrote to memory of 1424	3576	vbc.exe	schtasks.exe
PID 3576 wrote to memory of 1424	3576	vbc.exe	schtasks.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 3576 wrote to memory of 1224	3576	vbc.exe	vbc.exe
PID 1224 wrote to memory of 1736	1224	vbc.exe	dw20.exe
PID 1224 wrote to memory of 1736	1224	vbc.exe	dw20.exe
PID 1224 wrote to memory of 1736	1224	vbc.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SOEtXbQzHDdq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SOEtXbQzHDdq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4C38.tmp"
2⤵
- Creates scheduled task(s)
PID:1424

C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 692
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\vbc.exe.log
MD5
8849f2ad959553d9be276cf960a5ca7e

SHA1
b1a4be5cfa443ac6d1df4e4c1d9d6980aadab820

SHA256
acd871ad3e3199dc52b514078fd2c6ee21d6643616d5c9b4cb55760ce03b443b

SHA512
734c2e6526c6d2d8acde6d55bc45fddc1dc1b60adc653828d564d16042cc6939e282aa309d58b3a6f8c30e734b98201cb4a21fe0a3815d6a251093b30ef89115

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C38.tmp
MD5
2cc3e8e523e5a218c87cc390ecf72ae6

SHA1
6d97c7e11a945669895e7e7d7760a5a1988dc1a2

SHA256
c4345a446b8f75233ac91d90a5acea32557a42a91041cf59fc9d099c6de6a995

SHA512
7414bc1059cc4ea48d6a29e5b11439bc938b1f3eade65c6d46036b87909d59e21ea6898814a7840f3e2d8af5056371f2d02506bec45a91f7bb0a1bd4adac0ab5

Download Submit
memory/904-128-0x00000000044B2000-0x00000000044B3000-memory.dmp

Filesize
4KB

Download
memory/904-135-0x0000000007F20000-0x0000000007F21000-memory.dmp

Filesize
4KB

Download
memory/904-159-0x000000007F730000-0x000000007F731000-memory.dmp

Filesize
4KB

Download
memory/904-119-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/904-120-0x0000000006FF0000-0x0000000006FF1000-memory.dmp

Filesize
4KB

Download
memory/904-158-0x0000000009390000-0x0000000009391000-memory.dmp

Filesize
4KB

Download
memory/904-157-0x00000000091C0000-0x00000000091C1000-memory.dmp

Filesize
4KB

Download
memory/904-152-0x0000000009050000-0x0000000009051000-memory.dmp

Filesize
4KB

Download
memory/904-115-0x0000000000000000-mapping.dmp

Download
memory/904-130-0x0000000007620000-0x0000000007621000-memory.dmp

Filesize
4KB

Download
memory/904-126-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/904-127-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/904-118-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/904-160-0x00000000044B3000-0x00000000044B4000-memory.dmp

Filesize
4KB

Download
memory/904-145-0x0000000009090000-0x00000000090C3000-memory.dmp

Filesize
204KB

Download
memory/904-131-0x0000000007860000-0x0000000007861000-memory.dmp

Filesize
4KB

Download
memory/904-132-0x00000000078D0000-0x00000000078D1000-memory.dmp

Filesize
4KB

Download
memory/904-133-0x00000000076D0000-0x00000000076D1000-memory.dmp

Filesize
4KB

Download
memory/904-134-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/904-117-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/904-136-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/1224-123-0x000000000047032E-mapping.dmp

Download
memory/1224-122-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1224-129-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/1424-116-0x0000000000000000-mapping.dmp

Download
memory/1736-125-0x0000000000000000-mapping.dmp

Download
memory/3576-114-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads