matiex | cf66e10dd566b4a6241e4095abfa5b6366bb241986f3ded8d69331e443a969c2

General

Target

09d30f5e57629caacb86b013826ab1a2.exe
Size

576KB
MD5

09d30f5e57629caacb86b013826ab1a2
SHA1

0a72a42ad0b9c8ea853c7680af3231c9fe6faf8c
SHA256

cf66e10dd566b4a6241e4095abfa5b6366bb241986f3ded8d69331e443a969c2
SHA512

23c781775bc244d2c84ec12e40f2b3c9a7ddd2302631da1f30d66793eef0069d15cb585a51cc7f15a751adf01c1b13d39f42cde798abb29ffcf9d46f8c690c85
SSDEEP

12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZo:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pc5

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main payload 1 IoCs

resource	yara_rule
behavioral2/memory/3772-142-0x0000000000400000-0x0000000000482000-memory.dmp	family_matiex

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	checkip.dyndns.org
13	freegeoip.app
14	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	3772	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3740	schtasks.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1720	09d30f5e57629caacb86b013826ab1a2.exe
2416	09d30f5e57629caacb86b013826ab1a2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	09d30f5e57629caacb86b013826ab1a2.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1804	1720	09d30f5e57629caacb86b013826ab1a2.exe	84
PID 1720 wrote to memory of 1804	1720	09d30f5e57629caacb86b013826ab1a2.exe	84
PID 1720 wrote to memory of 1804	1720	09d30f5e57629caacb86b013826ab1a2.exe	84
PID 1720 wrote to memory of 3472	1720	09d30f5e57629caacb86b013826ab1a2.exe	85
PID 1720 wrote to memory of 3472	1720	09d30f5e57629caacb86b013826ab1a2.exe	85
PID 1720 wrote to memory of 3472	1720	09d30f5e57629caacb86b013826ab1a2.exe	85
PID 1720 wrote to memory of 2416	1720	09d30f5e57629caacb86b013826ab1a2.exe	86
PID 1720 wrote to memory of 2416	1720	09d30f5e57629caacb86b013826ab1a2.exe	86
PID 1720 wrote to memory of 2416	1720	09d30f5e57629caacb86b013826ab1a2.exe	86
PID 1804 wrote to memory of 3740	1804	cmd.exe	87
PID 1804 wrote to memory of 3740	1804	cmd.exe	87
PID 1804 wrote to memory of 3740	1804	cmd.exe	87
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	88
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	88
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	88
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	88

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe

C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
"C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
    3⤵
    - Creates scheduled task(s)
    PID:3740
- C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
  "C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
  "C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
    "C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1896
      4⤵
      Program crash
      PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3772 -ip 3772
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml

Filesize
1KB

MD5
6f269664e2d85ef4751b06251480c64d

SHA1
c6603dd2f40b166d3b0f1999ef0b7693ed0863b4

SHA256
cd7ea4acd44e3ffe110c32a42e1d8eab056e368b709767c7a176b68076bf3a1d

SHA512
c1feaead096bc2644098e659d881501a6ff40880acc6c25339776152ed5e4baad132dd69c12849a413d5f973a592c2e0c5fe6fd585813bdf9a8ec7b1d49c2962

Download Submit
memory/1720-135-0x00000000008FA000-0x0000000000900000-memory.dmp

Filesize
24KB

Download
memory/2416-138-0x000000000019A000-0x00000000001A0000-memory.dmp

Filesize
24KB

Download
memory/3772-140-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/3772-141-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/3772-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3772-143-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads