matiex | 2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22

General

Target

2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
Size

539KB
MD5

14c0aa0be46f3c46ad7a5b88bfd423dc
SHA1

816fc3e88dd989d457ce97311d4459a97123cc70
SHA256

2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22
SHA512

11cfb719d47d7afe6ea320d025c6655ea6ef0e07fd94111024c4e73ad7c0f40fe870f95731abf886243eba0b4a62c3be489452e1f69d791d946be2baf669f3db

Score

10^/10

matiex keylogger stealer

Malware Config

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1164-56-0x0000000000400000-0x0000000000483000-memory.dmp	family_matiex
behavioral1/memory/1164-60-0x0000000000490000-0x0000000000506000-memory.dmp	family_matiex

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

description	pid	process	target process
PID 1936 set thread context of 1164	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1476 schtasks.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

pid process

1936 2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

description pid process

Token: SeDebugPrivilege 1164 2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

pid	process
1476	schtasks.exe

pid	process
1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

description	pid	process
Token: SeDebugPrivilege	1164	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.execmd.exe

description	pid	process	target process
PID 1936 wrote to memory of 2000	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	cmd.exe
PID 1936 wrote to memory of 2000	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	cmd.exe
PID 1936 wrote to memory of 2000	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	cmd.exe
PID 1936 wrote to memory of 2000	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	cmd.exe
PID 1936 wrote to memory of 1164	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
PID 1936 wrote to memory of 1164	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
PID 1936 wrote to memory of 1164	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
PID 1936 wrote to memory of 1164	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
PID 1936 wrote to memory of 1164	1936	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe	2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
PID 2000 wrote to memory of 1476	2000	cmd.exe	schtasks.exe
PID 2000 wrote to memory of 1476	2000	cmd.exe	schtasks.exe
PID 2000 wrote to memory of 1476	2000	cmd.exe	schtasks.exe
PID 2000 wrote to memory of 1476	2000	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
"C:\Users\Admin\AppData\Local\Temp\2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d4c79d78a33a481894964ddfeeee395c.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d4c79d78a33a481894964ddfeeee395c.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1476
- C:\Users\Admin\AppData\Local\Temp\2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe
  "C:\Users\Admin\AppData\Local\Temp\2b0ed3756801df76e2d8a68ee8ec01c54794e46377aef121683f5f0dfedaff22.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4c79d78a33a481894964ddfeeee395c.xml

MD5
64c93af47c479be893f61afbc7472015

SHA1
400cd9cef7c8ab678063601c23c72453f1c10f16

SHA256
5bc83f04478cccb2c3bb4934f73efa55b8603924f671fcd647712c71f68bbc27

SHA512
500f5d3604859abdc602ad89fc4bf3cd4adfbce0c0d29714b17b473929d5b06cff67c4d44deed0166bc90a486d0c404f4e857073c4657efefaa2e431f8b64fe4

Download Submit
memory/1164-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1164-56-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1164-57-0x0000000074100000-0x00000000747EE000-memory.dmp

Filesize
6.9MB

Download
memory/1164-59-0x00000000044E1000-0x00000000044E2000-memory.dmp

Filesize
4KB

Download
memory/1164-60-0x0000000000490000-0x0000000000506000-memory.dmp

Filesize
472KB

Download
memory/1164-61-0x00000000044E2000-0x00000000044E3000-memory.dmp

Filesize
4KB

Download
memory/1164-62-0x00000000044E3000-0x00000000044E4000-memory.dmp

Filesize
4KB

Download
memory/1164-63-0x00000000044E4000-0x00000000044E5000-memory.dmp

Filesize
4KB

Download
memory/1936-54-0x00000000001EB000-0x00000000001F0000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads