matiex | efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

General

Target

efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
Size

246KB
MD5

2dade2e0c6d4d29ae58f4d62cbbeeee8
SHA1

87432db4e77f0dce442e1cbe00faf86b8ace3f35
SHA256

efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182
SHA512

2d01a4dd3be434ddb3d19af314eaf708325c7ffcd4cce9a4f33ac8932a65292e59d41dc9cbd3ea6a377d9e3f3713574cb0ebc7d601df337bd520ce1e8c3d5cb2

Score

10^/10

matiex keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
ze5qw@iC?1E}

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4264-133-0x0000000000400000-0x0000000000470000-memory.dmp	family_matiex

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

48 checkip.dyndns.org

flow	ioc
48	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe

description	pid	process	target process
PID 1904 set thread context of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exeefcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe

description	pid	process
Token: SeDebugPrivilege	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
Token: SeDebugPrivilege	4264	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe

description	pid	process	target process
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
PID 1904 wrote to memory of 4264	1904	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe	efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe

C:\Users\Admin\AppData\Local\Temp\efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
"C:\Users\Admin\AppData\Local\Temp\efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe
"C:\Users\Admin\AppData\Local\Temp\efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182.exe.log
Filesize
942B

MD5
6bdda504525dab642f6b2501909f5db9

SHA1
4ee3f943422d4ab46886aad80c0aebdf231a0426

SHA256
c295416053705f71b5287254d10d37efcbce5a07deda8785b1e5fc0985eeb00c

SHA512
c5ad8170c259ccd214cc43d759620b87e43f6dba8e0ff0a4f9ae2f3a962cec33d57f93f0514603ecde3809c882cc7f3be525e5e3c05bd9f2532acf11b2ee76b4

Download Submit
memory/1904-130-0x00000000005D0000-0x0000000000614000-memory.dmp

Filesize
272KB

Download
memory/1904-131-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/4264-132-0x0000000000000000-mapping.dmp

Download
memory/4264-133-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4264-135-0x0000000005600000-0x000000000569C000-memory.dmp

Filesize
624KB

Download
memory/4264-136-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads