matiex | 959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
26-03-2022 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Size

790KB
MD5

b3f376aa63caf6b537d4b6a7308e3b7b
SHA1

52157f01ff1b092e9ed9982b79ca2de272233c4a
SHA256

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d
SHA512

9c01fcc4d2b50c28b8ae38aee6318176cff91d16ad2f4d60b4f67032582fbcafb594c3938a00b330290a738bb9ce63f78b8574fd511d7474357b26005c479246

Score

10^/10

matiex collection evasion keylogger spyware stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: ftp
Host:
ftp://ftp.minister-finance.com/
Port:
21
Username:
[email protected]
Password:
Dakar@911

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2192-144-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Drops startup file 1 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\appdata.url	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

61 checkip.dyndns.org

flow	ioc
61	checkip.dyndns.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	pid	process	target process
PID 3620 set thread context of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2280 2192 WerFault.exe 959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3192 schtasks.exe

pid	pid_target	process	target process
2280	2192	WerFault.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

pid	process
3192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

pid	process
3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	pid	process
Token: SeDebugPrivilege	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
Token: SeDebugPrivilege	2192	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	pid	process	target process
PID 3620 wrote to memory of 3192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	schtasks.exe
PID 3620 wrote to memory of 3192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	schtasks.exe
PID 3620 wrote to memory of 3192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	schtasks.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
PID 3620 wrote to memory of 2192	3620	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

outlook_office_path 1 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

outlook_win_path 1 IoCs

Processes:

959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe

C:\Users\Admin\AppData\Local\Temp\959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
"C:\Users\Admin\AppData\Local\Temp\959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KmKrfVwAxR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp339B.tmp"
2⤵
- Creates scheduled task(s)
PID:3192

C:\Users\Admin\AppData\Local\Temp\959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe
"{path}"
2⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1724
3⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2192 -ip 2192
1⤵
PID:5056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\959c997ad7beaa75558665d28c9684515da2f5d5cb69b7a5375e1acbe397dc9d.exe.log
Filesize
1KB

MD5
ff7c98ebd1624ef8a7f8ba385fd3a3ea

SHA1
3d20f578d78e85c847723de6992cee00b4caaf75

SHA256
c190379a09e8c59d6ad32e782bd83294cbcb6de114a4ba988f65948179ed50e9

SHA512
670a1430f0624603ed510b52f2f7a540d68e8868a3f8a69f57105d3d66eff5e34c7041d8c2827d16141872ccf01ddad2c00bf4fb51cb2e333bb13f100575c1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp339B.tmp
Filesize
1KB

MD5
f35af1e2d18c2609469022bbbada20ad

SHA1
343222cefefebfb1e22f4814210feabedbaaf12d

SHA256
c1e24952e5014d2cb952532582e6de5f39803a45c6151c5abbee39c98e68b5f2

SHA512
b5ec045ed29bb9f67b8bb482d8ee39caeb10d6639f72e50d0b50011de730fe2d53954feae52731f43c8bc69c1568636f4ffca53b3aab7357f6682cce0b49d0b2

Download Submit
memory/2192-143-0x0000000000000000-mapping.dmp

Download
memory/2192-144-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3192-141-0x0000000000000000-mapping.dmp

Download
memory/3620-134-0x0000000000740000-0x000000000080E000-memory.dmp

Filesize
824KB

Download
memory/3620-135-0x000000000ADF0000-0x000000000B394000-memory.dmp

Filesize
5.6MB

Download
memory/3620-136-0x000000000AA20000-0x000000000AAB2000-memory.dmp

Filesize
584KB

Download
memory/3620-137-0x000000000A9F0000-0x000000000A9FA000-memory.dmp

Filesize
40KB

Download
memory/3620-138-0x000000000E270000-0x000000000E30C000-memory.dmp

Filesize
624KB

Download
memory/3620-139-0x000000000E840000-0x000000000ED6C000-memory.dmp

Filesize
5.2MB

Download
memory/3620-140-0x00000000011B0000-0x0000000001216000-memory.dmp

Filesize
408KB

Download