matiex | d8a2184f952bf70784f4fb038f3e38e755cdd7a550ade5b39143134fff251710

General

Target

Iterms.exe
Size

545KB
MD5

b1266a94b7dd2553fd9b30c2dfb72ae4
SHA1

0cb3165a1741cf80812ae22cccafb1385fcf4324
SHA256

cf8207bd6ead9bcadcaaaad2940956f75d90a67daf6ddb8dc1907900645a5f69
SHA512

1272483192f36adac3dc5c5feeb0da27456842573e59feb0e36803a17498372ade9c824960c9e2d8368a802ec0208887e1692841f2f76a6220800e18e7eb44e6

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
Ifiiedwin21@gmail.com
Password:
@@@monday

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1856-64-0x0000000000400000-0x0000000000474000-memory.dmp	family_matiex
behavioral1/memory/1856-65-0x0000000000400000-0x0000000000474000-memory.dmp	family_matiex
behavioral1/memory/1856-66-0x0000000000400000-0x0000000000474000-memory.dmp	family_matiex
behavioral1/memory/1856-67-0x000000000046E4EE-mapping.dmp	family_matiex
behavioral1/memory/1856-69-0x0000000000400000-0x0000000000474000-memory.dmp	family_matiex
behavioral1/memory/1856-71-0x0000000000400000-0x0000000000474000-memory.dmp	family_matiex

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Iterms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Iterms.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Iterms.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Iterms.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Iterms.exe

description pid process target process

PID 1700 set thread context of 1856 1700 Iterms.exe Iterms.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1936 1856 WerFault.exe Iterms.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1608 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Iterms.exe

pid process

1700 Iterms.exe
1700 Iterms.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Iterms.exeIterms.exe

description pid process

Token: SeDebugPrivilege 1700 Iterms.exe
Token: SeDebugPrivilege 1856 Iterms.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

description	pid	process	target process
PID 1700 set thread context of 1856	1700	Iterms.exe	Iterms.exe

pid	pid_target	process	target process
1936	1856	WerFault.exe	Iterms.exe

pid	process
1608	schtasks.exe

pid	process
1700	Iterms.exe
1700	Iterms.exe

description	pid	process
Token: SeDebugPrivilege	1700	Iterms.exe
Token: SeDebugPrivilege	1856	Iterms.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Iterms.exeIterms.exe

description	pid	process	target process
PID 1700 wrote to memory of 1608	1700	Iterms.exe	schtasks.exe
PID 1700 wrote to memory of 1608	1700	Iterms.exe	schtasks.exe
PID 1700 wrote to memory of 1608	1700	Iterms.exe	schtasks.exe
PID 1700 wrote to memory of 1608	1700	Iterms.exe	schtasks.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1700 wrote to memory of 1856	1700	Iterms.exe	Iterms.exe
PID 1856 wrote to memory of 1936	1856	Iterms.exe	WerFault.exe
PID 1856 wrote to memory of 1936	1856	Iterms.exe	WerFault.exe
PID 1856 wrote to memory of 1936	1856	Iterms.exe	WerFault.exe
PID 1856 wrote to memory of 1936	1856	Iterms.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

Iterms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Iterms.exe

outlook_win_path 1 IoCs

Processes:

Iterms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Iterms.exe

C:\Users\Admin\AppData\Local\Temp\Iterms.exe
"C:\Users\Admin\AppData\Local\Temp\Iterms.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5320.tmp"
2⤵
- Creates scheduled task(s)
PID:1608

C:\Users\Admin\AppData\Local\Temp\Iterms.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1772
3⤵
- Program crash
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5320.tmp
Filesize
1KB

MD5
dc436ff5b60ef8168376c73a193ed25c

SHA1
0943c8a1a0851b7b79d31fadb488cce2e0444638

SHA256
949ee6cece73e1304479fc963d79d2fd8e6410f451c1ce0ae6fd6e1b40b70705

SHA512
1f66711762ef86444a1e4edd5e3105b2ca5e83ec72bc6c2e04c7b5a9de1f50df3a6a85c75fc54003e4ebb0c9d8061455a6ef2e544726536592fb32dbf99736bd

Download Submit
memory/1608-59-0x0000000000000000-mapping.dmp

Download
memory/1700-54-0x0000000000340000-0x00000000003CE000-memory.dmp

Filesize
568KB

Download
memory/1700-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1700-56-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/1700-57-0x0000000002090000-0x00000000020F4000-memory.dmp

Filesize
400KB

Download
memory/1700-58-0x0000000004FF0000-0x000000000506E000-memory.dmp

Filesize
504KB

Download
memory/1856-62-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1856-61-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1856-64-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1856-65-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1856-66-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1856-67-0x000000000046E4EE-mapping.dmp

Download
memory/1856-69-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1856-71-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1936-73-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads