matiex | 53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

General

Target

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Size

562KB
MD5

bb3686437e0d66932c91effd44532f19
SHA1

c48e84822d9fd0ca1735de610d739252fc9266bd
SHA256

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e
SHA512

08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Score

10^/10

matiex agilenet keylogger persistence stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
mail.spamora.net
Port:
587
Username:
[email protected]
Password:
Emotion1

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1012-69-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex
behavioral1/memory/1012-70-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex
behavioral1/memory/1012-71-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex
behavioral1/memory/1012-72-0x000000000047204E-mapping.dmp	family_matiex
behavioral1/memory/1012-75-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex
behavioral1/memory/1012-77-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex

Executes dropped EXE 2 IoCs

Processes:

appmodule.exeappmodule.exe

pid process

1384 appmodule.exe
1012 appmodule.exe
Loads dropped DLL 2 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exeappmodule.exe

pid process

768 53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
1384 appmodule.exe

pid	process
1384	appmodule.exe
1012	appmodule.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/768-55-0x0000000000610000-0x000000000063A000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\whatsapp = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\appmodule.exe"	reg.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

appmodule.exe

description pid process target process

PID 1384 set thread context of 1012 1384 appmodule.exe appmodule.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 1384 set thread context of 1012	1384	appmodule.exe	appmodule.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exeappmodule.exe

pid	process
768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
1384	appmodule.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exeappmodule.exeappmodule.exe

description	pid	process
Token: SeDebugPrivilege	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Token: SeTakeOwnershipPrivilege	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Token: SeRestorePrivilege	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Token: SeDebugPrivilege	1384	appmodule.exe
Token: SeTakeOwnershipPrivilege	1384	appmodule.exe
Token: SeRestorePrivilege	1384	appmodule.exe
Token: SeDebugPrivilege	1012	appmodule.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.execmd.exeappmodule.exe

description	pid	process	target process
PID 768 wrote to memory of 1264	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 768 wrote to memory of 1264	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 768 wrote to memory of 1264	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 768 wrote to memory of 1264	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 1264 wrote to memory of 1536	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 1536	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 1536	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 1536	1264	cmd.exe	reg.exe
PID 768 wrote to memory of 1384	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 768 wrote to memory of 1384	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 768 wrote to memory of 1384	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 768 wrote to memory of 1384	768	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe
PID 1384 wrote to memory of 1012	1384	appmodule.exe	appmodule.exe

C:\Users\Admin\AppData\Local\Temp\53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
"C:\Users\Admin\AppData\Local\Temp\53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v whatsapp /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\appmodule.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v whatsapp /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\appmodule.exe"
    3⤵
    - Adds Run key to start application
    PID:1536
- C:\Users\Admin\AppData\Roaming\appmodule.exe
  "C:\Users\Admin\AppData\Roaming\appmodule.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Roaming\appmodule.exe
    "C:\Users\Admin\AppData\Roaming\appmodule.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
C:\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
C:\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
\Users\Admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
memory/768-55-0x0000000000610000-0x000000000063A000-memory.dmp

Filesize
168KB

Download
memory/768-54-0x0000000000130000-0x00000000001C2000-memory.dmp

Filesize
584KB

Download
memory/1012-70-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1012-72-0x000000000047204E-mapping.dmp

Download
memory/1012-77-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1012-75-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1012-71-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1012-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1012-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1012-69-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1264-56-0x0000000000000000-mapping.dmp

Download
memory/1384-65-0x0000000074E30000-0x0000000074EB0000-memory.dmp

Filesize
512KB

Download
memory/1384-62-0x0000000000E70000-0x0000000000F02000-memory.dmp

Filesize
584KB

Download
memory/1384-59-0x0000000000000000-mapping.dmp

Download
memory/1384-63-0x0000000000460000-0x000000000047C000-memory.dmp

Filesize
112KB

Download
memory/1536-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads