matiex | a36df06750c220466e159f6b8f097dc99c2bea8c6330ede922c7374d2e8dbe2b

General

Target

StormGeo_Invoice_202008242288..exe
Size

611KB
MD5

1685858a9090b769ef6dbbe8ad93ec85
SHA1

4e9c9b4dfabfd8605c4fc0f2af2522762dce94b2
SHA256

f3f9f4cc7099729cdea76954e338c0dd8d0404d50177a63ce50088aafea6ce26
SHA512

397923317110d8c356c75d75d155995a4918207eb6a43e62e7053737acc712ced9a8aab009cc3c8db5cfddf3dd54bea4221abaf137e424d09d71644f41256287

Score

10^/10

Family

matiex

Credentials

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1780-61-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/1780-62-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/1780-63-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/1780-64-0x000000000046DE7E-mapping.dmp	family_matiex

Suspicious use of SetThreadContext 1 IoCs

Processes:

StormGeo_Invoice_202008242288..exe

description pid process target process

PID 824 set thread context of 1780 824 StormGeo_Invoice_202008242288..exe StormGeo_Invoice_202008242288..exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

StormGeo_Invoice_202008242288..exe

pid process

824 StormGeo_Invoice_202008242288..exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

StormGeo_Invoice_202008242288..exe

description pid process

Token: SeDebugPrivilege 824 StormGeo_Invoice_202008242288..exe

description	pid	process	target process
PID 824 set thread context of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe

pid	process
824	StormGeo_Invoice_202008242288..exe

description	pid	process
Token: SeDebugPrivilege	824	StormGeo_Invoice_202008242288..exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

StormGeo_Invoice_202008242288..exe

description	pid	process	target process
PID 824 wrote to memory of 844	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 844	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 844	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 844	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe
PID 824 wrote to memory of 1780	824	StormGeo_Invoice_202008242288..exe	StormGeo_Invoice_202008242288..exe

C:\Users\Admin\AppData\Local\Temp\StormGeo_Invoice_202008242288..exe
"C:\Users\Admin\AppData\Local\Temp\StormGeo_Invoice_202008242288..exe"
2⤵
PID:844

C:\Users\Admin\AppData\Local\Temp\StormGeo_Invoice_202008242288..exe
"C:\Users\Admin\AppData\Local\Temp\StormGeo_Invoice_202008242288..exe"
2⤵
PID:1780

memory/824-54-0x0000000000D00000-0x0000000000D9E000-memory.dmp

Filesize
632KB

Download
memory/824-55-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/824-56-0x0000000006E90000-0x0000000006F08000-memory.dmp

Filesize
480KB

Download
memory/824-57-0x00000000072C0000-0x0000000007342000-memory.dmp

Filesize
520KB

Download
memory/1780-58-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1780-59-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1780-61-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1780-62-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1780-63-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1780-64-0x000000000046DE7E-mapping.dmp

Download