Overview

overview

10

Static

static

Purchase Order.exe

windows7_x64

10

Purchase Order.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6436220f58f40c5bb71a22f8cd94cfa47925ff16f49d4d9d6d3f44b8b6b15cc0

  • Size

    674KB

  • Sample

    220205-dwkjxsgbbj

  • MD5

    ac23f6dc4cf45a1d6595d3ba38e605e3

  • SHA1

    b204eba0b0ebc7b8cdfc41d9e41833b974c919a9

  • SHA256

    6436220f58f40c5bb71a22f8cd94cfa47925ff16f49d4d9d6d3f44b8b6b15cc0

  • SHA512

    1364199139527ca46820e3485e5494a6e01eaec2f313b537ed8d10ce5c1fc182afd2d56aba22c89d6d261397c904fca4025069db334fb2f46859c6b265d7b0b9

Score
10/10
matiexkeyloggerpersistencestealer

Malware Config

Extracted

Family

matiex

Credentials

Targets

    • Target

      Purchase Order.exe

    • Size

      724KB

    • MD5

      23af642a48892e044327f74a89a97f72

    • SHA1

      fb780966ab3e98bdda8e12923e38afb29db0e280

    • SHA256

      a0d80aba40063662d5a5e1257ce33985dbd1bc3517950c5e35cf8075c72454ed

    • SHA512

      e898d119493c9a4bd22a385e6c30edd80caa1bbb8f1e5e612f2e406a636f8abee82ac7b37930de45565e273c2ae8e031d713124b1156e80f54c9aad57f536e1d

    Score
    10/10
    matiexkeyloggerstealerpersistence

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Sets service image path in registry

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks