matiex | 2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e

Analysis

Target

2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe
Size

537KB
MD5

daaea507a91d60d4f3181affc9d2ffeb
SHA1

1bcba07eefde83737919533ce77c477e0b10dda0
SHA256

2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e
SHA512

2f98f0ab1548026ce3e3f3b413f80efe62cbf3a7a99668c44a35be5140de5b78131c347ca3af1bd4ac90d78e73e64ac5358e0daafc40ebb902597c092ee06e53

Score

10^/10

Family

matiex

Credentials

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1484-132-0x0000000000400000-0x0000000000476000-memory.dmp	family_matiex

Suspicious use of SetThreadContext 1 IoCs

Processes:

2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe

description	pid	process	target process
PID 4592 set thread context of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe

description	pid	process	target process
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe
PID 4592 wrote to memory of 1484	4592	2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\2f677e930c980bdc2d858e7e9d19041638a575e2edcf5ad6b88503251c4b739e.exe"
2⤵
PID:1484

memory/1484-131-0x0000000000000000-mapping.dmp

Download
memory/1484-132-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1484-133-0x00000000055A0000-0x000000000563C000-memory.dmp

Filesize
624KB

Download
memory/1484-134-0x0000000005640000-0x00000000056A6000-memory.dmp

Filesize
408KB

Download
memory/4592-130-0x0000000000C90000-0x0000000000CAC000-memory.dmp

Filesize
112KB

Download