matiex | a4c832d2df84b3c31d5d1daf2f02c3e48e9f4b3b6f5d2032bb2fc425c662de66

General

Target

DHL Shipment Info.exe
Size

606KB
MD5

c25c9e302e3bbc669e210c961e271f2e
SHA1

cd2a44a2bae5b250be394f21c947014f2c6d1aab
SHA256

6438b80d095ec295859cb2b1c099f1ae2ac0485705a447b991e84b551e40047e
SHA512

19e136ddc62dffce0512fcdac20e0b1fcc65e9366b4cda15e1cd80d6907a5247b31469eb0579275ce8ef06335b06fa291c3a6d1746b373b81caa03ff0cd14a14

Score

10^/10

matiex collection keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
mail.marketinfosales.com
Port:
587
Username:
[email protected]
Password:
v,,++Y&AiD(B

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-62-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2044-63-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2044-64-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2044-65-0x000000000046DEFE-mapping.dmp	family_matiex
behavioral1/memory/2044-67-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2044-69-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL Shipment Info.exe

description pid process target process

PID 824 set thread context of 2044 824 DHL Shipment Info.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

896 2044 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

DHL Shipment Info.exe

pid process

824 DHL Shipment Info.exe
824 DHL Shipment Info.exe
824 DHL Shipment Info.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL Shipment Info.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 824 DHL Shipment Info.exe
Token: SeDebugPrivilege 2044 RegSvcs.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

description	pid	process	target process
PID 824 set thread context of 2044	824	DHL Shipment Info.exe	RegSvcs.exe

pid	pid_target	process	target process
896	2044	WerFault.exe	RegSvcs.exe

pid	process
824	DHL Shipment Info.exe
824	DHL Shipment Info.exe
824	DHL Shipment Info.exe

description	pid	process
Token: SeDebugPrivilege	824	DHL Shipment Info.exe
Token: SeDebugPrivilege	2044	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

DHL Shipment Info.exeRegSvcs.exe

description	pid	process	target process
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 824 wrote to memory of 2044	824	DHL Shipment Info.exe	RegSvcs.exe
PID 2044 wrote to memory of 896	2044	RegSvcs.exe	WerFault.exe
PID 2044 wrote to memory of 896	2044	RegSvcs.exe	WerFault.exe
PID 2044 wrote to memory of 896	2044	RegSvcs.exe	WerFault.exe
PID 2044 wrote to memory of 896	2044	RegSvcs.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment Info.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Info.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 1764
3⤵
- Program crash
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-54-0x00000000002A0000-0x000000000033E000-memory.dmp

Filesize
632KB

Download
memory/824-55-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/824-56-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/824-57-0x0000000005BC0000-0x0000000005C46000-memory.dmp

Filesize
536KB

Download
memory/824-58-0x000000000A720000-0x000000000A7C8000-memory.dmp

Filesize
672KB

Download
memory/896-71-0x0000000000000000-mapping.dmp

Download
memory/2044-60-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2044-62-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2044-63-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2044-64-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2044-65-0x000000000046DEFE-mapping.dmp

Download
memory/2044-67-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2044-69-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2044-59-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads