matiex | b2be978e389bf6813270971a335eddb21f4eb81988ad9cb9f1ddb74286885fdd

General

Target
payment invoice090909000.exe
Size 478KB
Sample220503-a2falsgcan
SHA256 9a14ef7dd61e214e5d8f0ed0e4e98efdf3b6a97794e12e6c74811f85bf0fe021
MD5 5ce9199ca2f9bbfb99cf5dd672e884af
SHA1 484ce13dc8aed2309c2bbeb25b0136bbe5228114
SHA512 509af31de428567ab35be085259e78b88ddf0627c26baaf7d1c54099b531798815a436638523aae5ace4ea4017634057ff197abc579cc38ceb2841b14250ebfa
MD5 SHA1 SHA512

Score

10^/10

matiex collection keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol
smtp
Host
srvc13.turhost.com
Port
587
Username
[email protected]
Password
italik2015

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2064-135-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	checkip.dyndns.org
12	freegeoip.app
13	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 2064	4720	payment invoice090909000.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	2064	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4276	schtasks.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4720	payment invoice090909000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	MSBuild.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2368	4720	payment invoice090909000.exe	85
PID 4720 wrote to memory of 2368	4720	payment invoice090909000.exe	85
PID 4720 wrote to memory of 2368	4720	payment invoice090909000.exe	85
PID 4720 wrote to memory of 2064	4720	payment invoice090909000.exe	86
PID 4720 wrote to memory of 2064	4720	payment invoice090909000.exe	86
PID 4720 wrote to memory of 2064	4720	payment invoice090909000.exe	86
PID 4720 wrote to memory of 2064	4720	payment invoice090909000.exe	86
PID 2368 wrote to memory of 4276	2368	cmd.exe	87
PID 2368 wrote to memory of 4276	2368	cmd.exe	87
PID 2368 wrote to memory of 4276	2368	cmd.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\payment invoice090909000.exe
"C:\Users\Admin\AppData\Local\Temp\payment invoice090909000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\8b58fad2a4354d06a96543985b862504.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\8b58fad2a4354d06a96543985b862504.xml"
    3⤵
    - Creates scheduled task(s)
    PID:4276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\payment invoice090909000.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 1984
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2064 -ip 2064
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8b58fad2a4354d06a96543985b862504.xml

Path C:\Users\Admin\AppData\Local\Temp\8b58fad2a4354d06a96543985b862504.xml
Size 1KB
SHA256 e6cb647c0aee80cbac58f101ba47620657c8cd58f9a0aa91c6f8a4466e4ebc6f
MD5 57e80c1cd83971b009db6462dec561e8
SHA1 9890fc3fc7b93bb9dce0c624486307cff2a26927
SHA512 acc99eb56c615f669ef933c34ae86a1ba41a5ea5108a211de14107293d0bea7eb45e317bdb9b833b1262a1022fa4aa4462f4f3c6a19fa9481320dbb75ee41dd6
MD5 SHA1 SHA512

Submit Download

memory/2064-135-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/2064-136-0x00000000056F0000-0x000000000578C000-memory.dmp

Download

memory/2064-137-0x0000000005DC0000-0x0000000006364000-memory.dmp

Download

memory/2064-138-0x0000000005810000-0x0000000005876000-memory.dmp

Download

memory/4720-132-0x0000000000AFA000-0x0000000000B00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads