matiex | e9b3b04a100743999604de3bac9da0c68b624799d6a368ee36f9dd788f47f5b5

General

Target

BOSSSMAN.exe
Size

644KB
MD5

4f338356047edd4cb0539e2cf2f578c4
SHA1

7b3e3d83ab3a18c4a5b83fc81c974356a483b2dd
SHA256

94d2d1aeebeff231fe2536de9f0d7eb42f80686b30ee6a54e3019670f381b943
SHA512

569bfd7374f6ac810d1d99c1a67695a0fe39fdf7ee703e007368aee7614dc7032c5745c0a52af8c5b1307b0f0a793464a89030e9fd0ec9f6e1c20da516850225

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1349136320:AAF_leU6IwK-rjQSNBBUahnIxBl79Wj_x7E/sendMessage?chat_id=1097126233

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3504-132-0x0000000000AA0000-0x0000000000B10000-memory.dmp	family_matiex
behavioral2/memory/3504-133-0x0000000000AA0000-0x0000000000B10000-memory.dmp	family_matiex

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

BOSSSMAN.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BOSSSMAN.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BOSSSMAN.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BOSSSMAN.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

BOSSSMAN.exe

description pid process target process

PID 2868 set thread context of 3504 2868 BOSSSMAN.exe BOSSSMAN.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 3504 WerFault.exe BOSSSMAN.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

BOSSSMAN.exe

pid process

2868 BOSSSMAN.exe
2868 BOSSSMAN.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

BOSSSMAN.exe

pid process

2868 BOSSSMAN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BOSSSMAN.exe

description pid process

Token: SeDebugPrivilege 3504 BOSSSMAN.exe

flow	ioc
5	checkip.dyndns.org

description	pid	process	target process
PID 2868 set thread context of 3504	2868	BOSSSMAN.exe	BOSSSMAN.exe

pid	pid_target	process	target process
2300	3504	WerFault.exe	BOSSSMAN.exe

pid	process
2868	BOSSSMAN.exe
2868	BOSSSMAN.exe

pid	process
2868	BOSSSMAN.exe

description	pid	process
Token: SeDebugPrivilege	3504	BOSSSMAN.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

BOSSSMAN.exe

description	pid	process	target process
PID 2868 wrote to memory of 3504	2868	BOSSSMAN.exe	BOSSSMAN.exe
PID 2868 wrote to memory of 3504	2868	BOSSSMAN.exe	BOSSSMAN.exe
PID 2868 wrote to memory of 3504	2868	BOSSSMAN.exe	BOSSSMAN.exe

outlook_office_path 1 IoCs

Processes:

BOSSSMAN.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BOSSSMAN.exe

outlook_win_path 1 IoCs

Processes:

BOSSSMAN.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BOSSSMAN.exe

C:\Users\Admin\AppData\Local\Temp\BOSSSMAN.exe
"C:\Users\Admin\AppData\Local\Temp\BOSSSMAN.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\BOSSSMAN.exe
"C:\Users\Admin\AppData\Local\Temp\BOSSSMAN.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 1736
3⤵
- Program crash
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3504 -ip 3504
1⤵
PID:4364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-134-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3504-131-0x0000000000000000-mapping.dmp

Download
memory/3504-132-0x0000000000AA0000-0x0000000000B10000-memory.dmp

Filesize
448KB

Download
memory/3504-133-0x0000000000AA0000-0x0000000000B10000-memory.dmp

Filesize
448KB

Download
memory/3504-135-0x0000000004A50000-0x0000000004AEC000-memory.dmp

Filesize
624KB

Download
memory/3504-136-0x0000000004AF0000-0x0000000005094000-memory.dmp

Filesize
5.6MB

Download
memory/3504-137-0x00000000050F0000-0x0000000005156000-memory.dmp

Filesize
408KB

Download
memory/3504-138-0x0000000006070000-0x0000000006232000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads