matiex | 5202d7287ca941b6d0951dd9fa84d721492fc30116bf90349a792ed22a06d7e6

General

Target

PRODUCT LIST AND REQUIREMENTS.exe
Size

1.9MB
MD5

e2f1babb1a1eef2ae65c6ea38d6a0549
SHA1

c8e7d6f27afd909570408078d3322368d5e48a9f
SHA256

5202d7287ca941b6d0951dd9fa84d721492fc30116bf90349a792ed22a06d7e6
SHA512

2af1070cefa4e92896a1c5d6a33992a5d3b0e947fc06ec40a76040aba0951a85a227515e2e20508a7fc9facf180232714cb09750944c7c320ec54bea2bf19a69

Score

10^/10

matiex collection keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
collectionsolutionslimited.com
Port:
587
Username:
[email protected]
Password:
destination1950
Email To:
[email protected]

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1372-61-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/1372-62-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/1372-63-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral1/memory/1372-64-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

PRODUCT LIST AND REQUIREMENTS.exe

description pid process target process

PID 2008 set thread context of 1372 2008 PRODUCT LIST AND REQUIREMENTS.exe aspnet_compiler.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1760 1372 WerFault.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1760 WerFault.exe
1760 WerFault.exe
1760 WerFault.exe
1760 WerFault.exe
1760 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1760 WerFault.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

description	pid	process	target process
PID 2008 set thread context of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe

pid	pid_target	process	target process
1760	1372	WerFault.exe	aspnet_compiler.exe

pid	process
1760	WerFault.exe
1760	WerFault.exe
1760	WerFault.exe
1760	WerFault.exe
1760	WerFault.exe

pid	process
1760	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PRODUCT LIST AND REQUIREMENTS.exeaspnet_compiler.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2008	PRODUCT LIST AND REQUIREMENTS.exe
Token: SeDebugPrivilege	1372	aspnet_compiler.exe
Token: SeDebugPrivilege	1760	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PRODUCT LIST AND REQUIREMENTS.exeaspnet_compiler.exe

description	pid	process	target process
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 2008 wrote to memory of 1372	2008	PRODUCT LIST AND REQUIREMENTS.exe	aspnet_compiler.exe
PID 1372 wrote to memory of 1760	1372	aspnet_compiler.exe	WerFault.exe
PID 1372 wrote to memory of 1760	1372	aspnet_compiler.exe	WerFault.exe
PID 1372 wrote to memory of 1760	1372	aspnet_compiler.exe	WerFault.exe
PID 1372 wrote to memory of 1760	1372	aspnet_compiler.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST AND REQUIREMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST AND REQUIREMENTS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 1756
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-63-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1372-62-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1372-65-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/1372-61-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1372-64-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1372-59-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1372-60-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1760-66-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/1760-67-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2008-55-0x000000001AC00000-0x000000001AC02000-memory.dmp

Filesize
8KB

Download
memory/2008-58-0x0000000000B90000-0x0000000000BAA000-memory.dmp

Filesize
104KB

Download
memory/2008-54-0x0000000000810000-0x00000000009F8000-memory.dmp

Filesize
1.9MB

Download
memory/2008-57-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download
memory/2008-56-0x000000001B5C0000-0x000000001B76A000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads