Overview

overview

10

Static

static

1

9964f92127...15.exe

windows7-x64

8

9964f92127...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9964f9212756726e0d408494d9f8535d2e8c38698415bc6d51fa65ac6b2e7b15

  • Size

    600KB

  • Sample

    221108-rk6jxabeb8

  • MD5

    5799475fff1d04852a9554602b8f77d0

  • SHA1

    031174b3ab416f24e7cae3b1f7f9e0ec6b93e750

  • SHA256

    9964f9212756726e0d408494d9f8535d2e8c38698415bc6d51fa65ac6b2e7b15

  • SHA512

    4d82c1cd5eceaddadbc3a7d5ca68d467de1b06a970842864fab94c965f8cb9ec8d1c70719bbd08f005edc628e20d8b8fbcce8de7afb67bb49907be0fb3d38fbd

  • SSDEEP

    12288:ln/B3hN4SuIZYO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHL:lnB47IZYZlT+lQTD/O3BArRCHL

Score
10/10
matiexcollectionkeyloggerpersistencespywarestealerupx

Malware Config

Targets

    • Target

      9964f9212756726e0d408494d9f8535d2e8c38698415bc6d51fa65ac6b2e7b15

    • Size

      600KB

    • MD5

      5799475fff1d04852a9554602b8f77d0

    • SHA1

      031174b3ab416f24e7cae3b1f7f9e0ec6b93e750

    • SHA256

      9964f9212756726e0d408494d9f8535d2e8c38698415bc6d51fa65ac6b2e7b15

    • SHA512

      4d82c1cd5eceaddadbc3a7d5ca68d467de1b06a970842864fab94c965f8cb9ec8d1c70719bbd08f005edc628e20d8b8fbcce8de7afb67bb49907be0fb3d38fbd

    • SSDEEP

      12288:ln/B3hN4SuIZYO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHL:lnB47IZYZlT+lQTD/O3BArRCHL

    Score
    10/10
    persistencematiexcollectionkeyloggerspywarestealerupx

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks