matiex | f8d7d56e031ac6296d85ef52def961af07dc81b496c58c49d04c3bb70731ebef

General

Target

m60980.exe
Size

602KB
MD5

65134f2b82de31f29c1350af7f03e194
SHA1

341648365f3bbc992ef4cc68480ec059537621f0
SHA256

a5558fff1ebe81b0f0534b51d9329ef59e867d5281d78a149e66fa6c218f0ef4
SHA512

fd8189db2c352801b2662045a89f09251b1326424d24481fa2f90a927900e9ee5b7cbbaf2951cce12f27834a6792cbbc329a3d572835952146cb3f0ddb3ec05f

Score

10^/10

Family

matiex

C2

https://api.telegram.org/bot1395392888:AAFrJovDdZICOFB0gX0eGWrAUzEKCRpv8xo/sendMessage?chat_id=1300181783

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/548-62-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/548-63-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/548-64-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/548-65-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/548-67-0x0000000005480000-0x00000000056C0000-memory.dmp	family_matiex

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

m60980.exe

description pid process target process

PID 1364 set thread context of 548 1364 m60980.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

548 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 548 MSBuild.exe

description	pid	process	target process
PID 1364 set thread context of 548	1364	m60980.exe	MSBuild.exe

pid	process
548	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	548	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

m60980.exe

description	pid	process	target process
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe
PID 1364 wrote to memory of 548	1364	m60980.exe	MSBuild.exe

memory/548-60-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/548-61-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/548-62-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/548-63-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/548-64-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/548-65-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/548-67-0x0000000005480000-0x00000000056C0000-memory.dmp

Filesize
2.2MB

Download
memory/1364-55-0x0000000000DF0000-0x0000000000E8C000-memory.dmp

Filesize
624KB

Download
memory/1364-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1364-57-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1364-58-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/1364-59-0x0000000005000000-0x00000000050A4000-memory.dmp

Filesize
656KB

Download