matiex | b84beac430d5c3fd06f4a1016e305884689eba7596eea1d6ca8ffa2122f341ff

General

Target

pictures and logo.exe
Size

669KB
MD5

4fa42a8beb305337e28cede06ceefa62
SHA1

1ad401dc70385788123ae837eea020a9c1d9e9d9
SHA256

c38b853587846014052d5b2206e8764dac66f7de9479ec3080e1872938bd7ceb
SHA512

81dc56b84e3e95169de458d5842c50347455365388b96155aa25a7fea27dc756d20180265ee2b796b2d6ebc2d04d622a6fa9259877f371e956e1458415046807

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
smtp.privateemail.com
Port:
587
Username:
[email protected]
Password:
MARYolanmauluogwo@ever

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral8/memory/4052-141-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex
behavioral8/memory/4052-145-0x0000000005740000-0x0000000005CE4000-memory.dmp	family_matiex

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4716 created 4052 4716 WerFault.exe pictures and logo.exe

description	pid	process	target process
PID 4716 created 4052	4716	WerFault.exe	pictures and logo.exe

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Powershell.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

pictures and logo.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pictures and logo.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pictures and logo.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pictures and logo.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

40 checkip.dyndns.org
42 freegeoip.app
43 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

pictures and logo.exe

description pid process target process

PID 456 set thread context of 4052 456 pictures and logo.exe pictures and logo.exe

flow	ioc
40	checkip.dyndns.org
42	freegeoip.app
43	freegeoip.app

description	pid	process	target process
PID 456 set thread context of 4052	456	pictures and logo.exe	pictures and logo.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3088 4052 WerFault.exe pictures and logo.exe

pid	pid_target	process	target process
3088	4052	WerFault.exe	pictures and logo.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exeWerFault.exe

pid process

3020 Powershell.exe
3020 Powershell.exe
3088 WerFault.exe
3088 WerFault.exe

pid	process
3020	Powershell.exe
3020	Powershell.exe
3088	WerFault.exe
3088	WerFault.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

Powershell.exepictures and logo.exeWerFault.exesvchost.exeTiWorker.exe

description	pid	process
Token: SeDebugPrivilege	3020	Powershell.exe
Token: SeDebugPrivilege	4052	pictures and logo.exe
Token: SeRestorePrivilege	3088	WerFault.exe
Token: SeBackupPrivilege	3088	WerFault.exe
Token: SeShutdownPrivilege	920	svchost.exe
Token: SeCreatePagefilePrivilege	920	svchost.exe
Token: SeShutdownPrivilege	920	svchost.exe
Token: SeCreatePagefilePrivilege	920	svchost.exe
Token: SeShutdownPrivilege	920	svchost.exe
Token: SeCreatePagefilePrivilege	920	svchost.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe
Token: SeBackupPrivilege	3912	TiWorker.exe
Token: SeRestorePrivilege	3912	TiWorker.exe
Token: SeSecurityPrivilege	3912	TiWorker.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

pictures and logo.exeWerFault.exe

description	pid	process	target process
PID 456 wrote to memory of 3020	456	pictures and logo.exe	Powershell.exe
PID 456 wrote to memory of 3020	456	pictures and logo.exe	Powershell.exe
PID 456 wrote to memory of 3020	456	pictures and logo.exe	Powershell.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 456 wrote to memory of 4052	456	pictures and logo.exe	pictures and logo.exe
PID 4716 wrote to memory of 4052	4716	WerFault.exe	pictures and logo.exe
PID 4716 wrote to memory of 4052	4716	WerFault.exe	pictures and logo.exe

outlook_office_path 1 IoCs

Processes:

pictures and logo.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pictures and logo.exe

outlook_win_path 1 IoCs

Processes:

pictures and logo.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pictures and logo.exe

C:\Users\Admin\AppData\Local\Temp\pictures and logo.exe
"C:\Users\Admin\AppData\Local\Temp\pictures and logo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\pictures and logo.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Users\Admin\AppData\Local\Temp\pictures and logo.exe
"C:\Users\Admin\AppData\Local\Temp\pictures and logo.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 2020
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4052 -ip 4052
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-130-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/456-131-0x00000000007D0000-0x000000000087E000-memory.dmp

Filesize
696KB

Download
memory/456-132-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/456-133-0x0000000005830000-0x0000000005CFC000-memory.dmp

Filesize
4.8MB

Download
memory/456-134-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/456-135-0x00000000062B0000-0x0000000006854000-memory.dmp

Filesize
5.6MB

Download
memory/456-136-0x00000000054A0000-0x000000000553C000-memory.dmp

Filesize
624KB

Download
memory/920-159-0x000002A9D3120000-0x000002A9D3124000-memory.dmp

Filesize
16KB

Download
memory/920-152-0x000002A9D03A0000-0x000002A9D03B0000-memory.dmp

Filesize
64KB

Download
memory/3020-142-0x0000000005880000-0x0000000005EA8000-memory.dmp

Filesize
6.2MB

Download
memory/3020-149-0x0000000006BD0000-0x0000000006C66000-memory.dmp

Filesize
600KB

Download
memory/3020-137-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/3020-139-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/3020-138-0x0000000002D40000-0x0000000002D76000-memory.dmp

Filesize
216KB

Download
memory/3020-151-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

Filesize
136KB

Download
memory/3020-150-0x0000000006B50000-0x0000000006B6A000-memory.dmp

Filesize
104KB

Download
memory/3020-146-0x00000000057A0000-0x00000000057C2000-memory.dmp

Filesize
136KB

Download
memory/3020-147-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Filesize
408KB

Download
memory/3020-148-0x0000000006650000-0x000000000666E000-memory.dmp

Filesize
120KB

Download
memory/3020-140-0x0000000005242000-0x0000000005243000-memory.dmp

Filesize
4KB

Download
memory/4052-145-0x0000000005740000-0x0000000005CE4000-memory.dmp

Filesize
5.6MB

Download
memory/4052-144-0x0000000074AC0000-0x0000000075270000-memory.dmp

Filesize
7.7MB

Download
memory/4052-143-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/4052-141-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads