Overview

overview

10

Static

static

aa1c59367a...e3.exe

windows7_x64

10

aa1c59367a...e3.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    157s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    29-03-2022 18:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa1c59367acc2fe60523b7d0299fb4ec70bd4562a78de4dc7fea43dff55c97e3.exe

  • Size

    1002KB

  • MD5

    45245660e7e83484e772aa6cbc1ab65e

  • SHA1

    6d3dc8803bc22bf815000c5013a825bf8ac2285d

  • SHA256

    aa1c59367acc2fe60523b7d0299fb4ec70bd4562a78de4dc7fea43dff55c97e3

  • SHA512

    1347bca45c75794d6b18be877fa711c7c9a498ac3a06ab8903b2a9e6bb3c3c7dd647d0a7cbecbd3dfa498d4a2e967595f67a83564e2f153ff38efcfb6b71d999

Score
10/10
matiexcollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/[email protected]/sendMessage?chat_id=Kilimanjaro@123

Signatures

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex
  • Matiex Main Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa1c59367acc2fe60523b7d0299fb4ec70bd4562a78de4dc7fea43dff55c97e3.exe
    "C:\Users\Admin\AppData\Local\Temp\aa1c59367acc2fe60523b7d0299fb4ec70bd4562a78de4dc7fea43dff55c97e3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\aa1c59367acc2fe60523b7d0299fb4ec70bd4562a78de4dc7fea43dff55c97e3.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1520
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:480
    • C:\Windows\System32\Upfc.exe
      C:\Windows\System32\Upfc.exe /launchtype periodic /cv fYAceUPEUU+DE/lvwH5Jzw.0
      1⤵
        PID:5016

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aa1c59367acc2fe60523b7d0299fb4ec70bd4562a78de4dc7fea43dff55c97e3.exe.log
        Filesize

        1KB

        MD5

        6f8f3a9a57cb30e686d3355e656031e0

        SHA1

        acccd6befb1a2f40e662280bc5182e086a0d079b

        SHA256

        283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

        SHA512

        8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

        Download Submit
      • memory/480-140-0x0000000000000000-mapping.dmp
        Download
      • memory/1520-139-0x0000000005730000-0x0000000005796000-memory.dmp
        Filesize

        408KB

        Download
      • memory/1520-136-0x0000000000000000-mapping.dmp
        Download
      • memory/1520-137-0x0000000000400000-0x0000000000478000-memory.dmp
        Filesize

        480KB

        Download
      • memory/1520-141-0x0000000007610000-0x00000000077D2000-memory.dmp
        Filesize

        1.8MB

        Download
      • memory/1520-142-0x00000000057C0000-0x0000000005D64000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/2736-133-0x0000000004F90000-0x0000000004F9A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/2736-134-0x0000000007B70000-0x000000000809C000-memory.dmp
        Filesize

        5.2MB

        Download
      • memory/2736-135-0x0000000008380000-0x000000000841C000-memory.dmp
        Filesize

        624KB

        Download
      • memory/2736-132-0x0000000004FA0000-0x0000000005032000-memory.dmp
        Filesize

        584KB

        Download
      • memory/2736-130-0x00000000004F0000-0x00000000005F0000-memory.dmp
        Filesize

        1024KB

        Download
      • memory/2736-131-0x0000000005650000-0x0000000005BF4000-memory.dmp
        Filesize

        5.6MB

        Download