matiex | 53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

General

Target

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Size

562KB
MD5

bb3686437e0d66932c91effd44532f19
SHA1

c48e84822d9fd0ca1735de610d739252fc9266bd
SHA256

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e
SHA512

08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Score

10^/10

matiex keylogger persistence stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
mail.spamora.net
Port:
587
Username:
[email protected]
Password:
Emotion1

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1636-136-0x0000000000400000-0x0000000000478000-memory.dmp	family_matiex

Executes dropped EXE 2 IoCs

Processes:

appmodule.exeappmodule.exe

pid process

900 appmodule.exe
1636 appmodule.exe

pid	process
900	appmodule.exe
1636	appmodule.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe

Loads dropped DLL 1 IoCs

Processes:

appmodule.exe

pid process

900 appmodule.exe

pid	process
900	appmodule.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whatsapp = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\appmodule.exe"	reg.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

68 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

appmodule.exe

description pid process target process

PID 900 set thread context of 1636 900 appmodule.exe appmodule.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
68	checkip.dyndns.org

description	pid	process	target process
PID 900 set thread context of 1636	900	appmodule.exe	appmodule.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exeappmodule.exe

pid	process
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
900	appmodule.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exeappmodule.exeappmodule.exe

description	pid	process
Token: SeDebugPrivilege	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Token: SeTakeOwnershipPrivilege	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Token: SeRestorePrivilege	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
Token: SeDebugPrivilege	900	appmodule.exe
Token: SeTakeOwnershipPrivilege	900	appmodule.exe
Token: SeRestorePrivilege	900	appmodule.exe
Token: SeDebugPrivilege	1636	appmodule.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.execmd.exeappmodule.exe

description	pid	process	target process
PID 2040 wrote to memory of 216	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 2040 wrote to memory of 216	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 2040 wrote to memory of 216	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	cmd.exe
PID 216 wrote to memory of 4288	216	cmd.exe	reg.exe
PID 216 wrote to memory of 4288	216	cmd.exe	reg.exe
PID 216 wrote to memory of 4288	216	cmd.exe	reg.exe
PID 2040 wrote to memory of 900	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 2040 wrote to memory of 900	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 2040 wrote to memory of 900	2040	53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe
PID 900 wrote to memory of 1636	900	appmodule.exe	appmodule.exe

C:\Users\Admin\AppData\Local\Temp\53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe
"C:\Users\Admin\AppData\Local\Temp\53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v whatsapp /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\appmodule.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v whatsapp /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\appmodule.exe"
    3⤵
    - Adds Run key to start application
    PID:4288
- C:\Users\Admin\AppData\Roaming\appmodule.exe
  "C:\Users\Admin\AppData\Roaming\appmodule.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Users\Admin\AppData\Roaming\appmodule.exe
    "C:\Users\Admin\AppData\Roaming\appmodule.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\appmodule.exe.log

Filesize
1KB

MD5
769d8660bec929b34823b17aa9a84297

SHA1
d4c40a5a6bc25d4bfd4c7442fbebfa1255cd322f

SHA256
19cb9087c56aeccc56ec96363dfe7128b651d7c450c81e453e2e29f3fabf8da3

SHA512
2b16f6d92a616b26a06c196c4a123d2959e626f97d328cb69e11e3715e71aa083f66083f68a90ac85e2bccb6e963eac5173dda1023fe5c64f45d78a8c38f2883

Download Submit
C:\Users\Admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
C:\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
C:\Users\Admin\AppData\Roaming\appmodule.exe

Filesize
562KB

MD5
bb3686437e0d66932c91effd44532f19

SHA1
c48e84822d9fd0ca1735de610d739252fc9266bd

SHA256
53833eaa5c4c091fb3e25aa7707d1ff5ecf01aa3a69da439742186466c85042e

SHA512
08e0b6a16d68ecf2e97a4f5d0ad5be677674d666f10d9a6911941cc34bbe1e3d34c37b842483990e0705fc9ed5790a83023fe539243913199d6b03bb583c3c06

Download Submit
memory/216-128-0x0000000000000000-mapping.dmp

Download
memory/900-130-0x0000000000000000-mapping.dmp

Download
memory/900-134-0x0000000073AD0000-0x0000000073B59000-memory.dmp

Filesize
548KB

Download
memory/1636-135-0x0000000000000000-mapping.dmp

Download
memory/1636-136-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1636-139-0x0000000004F90000-0x000000000502C000-memory.dmp

Filesize
624KB

Download
memory/1636-140-0x0000000005030000-0x0000000005096000-memory.dmp

Filesize
408KB

Download
memory/2040-124-0x0000000000900000-0x0000000000992000-memory.dmp

Filesize
584KB

Download
memory/2040-127-0x0000000005430000-0x00000000054C2000-memory.dmp

Filesize
584KB

Download
memory/2040-126-0x0000000005340000-0x0000000005384000-memory.dmp

Filesize
272KB

Download
memory/2040-125-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/4288-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads