Overview

overview

10

Static

static

Tax Invoic...2).exe

windows7_x64

10

Tax Invoic...2).exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6422e920c2e9dadbb7218fd013230f7617feb8725aa31e3990032da3b5673282

  • Size

    671KB

  • Sample

    220502-1csshsbfg2

  • MD5

    0fe67082415f458a0aa2c4b27711c39e

  • SHA1

    4760246fc24916442b12426680be87c8828f4fb2

  • SHA256

    6422e920c2e9dadbb7218fd013230f7617feb8725aa31e3990032da3b5673282

  • SHA512

    ee1e33be09664285a44b425f5214854e4e1f4347fd8e27c888b6a2d3083720d1c7c147e4a5c499536771079653df3b70e4e4fdd6e7b7e9fbf5c8f85f8b9dc2bc

Score
10/10
matiexcollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    srvc13.turhost.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    italik2015

Targets

    • Target

      Tax Invoices IN102738 IN102739 IN102740 (2).exe

    • Size

      867KB

    • MD5

      1edc97d794a36b1e6c0c4757f56becad

    • SHA1

      8ff5c4d412ac10443a79e02f80579c1d5f0c53e2

    • SHA256

      d2e9e5d1c73e145f6ca508dd8f1397ea4ce5fa1172468889f65133f0af0d08ea

    • SHA512

      e820ea714c71e671557e3e2b32c4c6690cd48f04cd3c5480cf4822a3acb51e522577fc3e500f7fe4b473f7c8a210987b36268ec8bcbe08c8f4766dc3f9876917

    Score
    10/10
    matiexcollectionkeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks