matiex | cf66e10dd566b4a6241e4095abfa5b6366bb241986f3ded8d69331e443a969c2

General

Target

09d30f5e57629caacb86b013826ab1a2.exe
Size

576KB
MD5

09d30f5e57629caacb86b013826ab1a2
SHA1

0a72a42ad0b9c8ea853c7680af3231c9fe6faf8c
SHA256

cf66e10dd566b4a6241e4095abfa5b6366bb241986f3ded8d69331e443a969c2
SHA512

23c781775bc244d2c84ec12e40f2b3c9a7ddd2302631da1f30d66793eef0069d15cb585a51cc7f15a751adf01c1b13d39f42cde798abb29ffcf9d46f8c690c85
SSDEEP

12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZo:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pc5

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3772-142-0x0000000000400000-0x0000000000482000-memory.dmp	family_matiex

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

09d30f5e57629caacb86b013826ab1a2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 checkip.dyndns.org
13 freegeoip.app
14 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

09d30f5e57629caacb86b013826ab1a2.exe

description pid process target process

PID 2416 set thread context of 3772 2416 09d30f5e57629caacb86b013826ab1a2.exe 09d30f5e57629caacb86b013826ab1a2.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 3772 WerFault.exe 09d30f5e57629caacb86b013826ab1a2.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3740 schtasks.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

09d30f5e57629caacb86b013826ab1a2.exe09d30f5e57629caacb86b013826ab1a2.exe

pid process

1720 09d30f5e57629caacb86b013826ab1a2.exe
2416 09d30f5e57629caacb86b013826ab1a2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

09d30f5e57629caacb86b013826ab1a2.exe

description pid process

Token: SeDebugPrivilege 3772 09d30f5e57629caacb86b013826ab1a2.exe

flow	ioc
11	checkip.dyndns.org
13	freegeoip.app
14	freegeoip.app

description	pid	process	target process
PID 2416 set thread context of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe

pid	pid_target	process	target process
1528	3772	WerFault.exe	09d30f5e57629caacb86b013826ab1a2.exe

pid	process
3740	schtasks.exe

pid	process
1720	09d30f5e57629caacb86b013826ab1a2.exe
2416	09d30f5e57629caacb86b013826ab1a2.exe

description	pid	process
Token: SeDebugPrivilege	3772	09d30f5e57629caacb86b013826ab1a2.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

09d30f5e57629caacb86b013826ab1a2.execmd.exe09d30f5e57629caacb86b013826ab1a2.exe

outlook_office_path 1 IoCs

Processes:

09d30f5e57629caacb86b013826ab1a2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe

outlook_win_path 1 IoCs

Processes:

09d30f5e57629caacb86b013826ab1a2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	09d30f5e57629caacb86b013826ab1a2.exe

C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
"C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
3⤵
- Creates scheduled task(s)
PID:3740

C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
"C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
2⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
"C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe
"C:\Users\Admin\AppData\Local\Temp\09d30f5e57629caacb86b013826ab1a2.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1896
4⤵
- Program crash
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3772 -ip 3772
1⤵
PID:3080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml
Filesize
1KB

MD5
6f269664e2d85ef4751b06251480c64d

SHA1
c6603dd2f40b166d3b0f1999ef0b7693ed0863b4

SHA256
cd7ea4acd44e3ffe110c32a42e1d8eab056e368b709767c7a176b68076bf3a1d

SHA512
c1feaead096bc2644098e659d881501a6ff40880acc6c25339776152ed5e4baad132dd69c12849a413d5f973a592c2e0c5fe6fd585813bdf9a8ec7b1d49c2962

Download Submit
memory/1720-135-0x00000000008FA000-0x0000000000900000-memory.dmp

Filesize
24KB

Download
memory/1804-132-0x0000000000000000-mapping.dmp

Download
memory/2416-134-0x0000000000000000-mapping.dmp

Download
memory/2416-138-0x000000000019A000-0x00000000001A0000-memory.dmp

Filesize
24KB

Download
memory/3472-133-0x0000000000000000-mapping.dmp

Download
memory/3740-136-0x0000000000000000-mapping.dmp

Download
memory/3772-137-0x0000000000000000-mapping.dmp

Download
memory/3772-140-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/3772-141-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/3772-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3772-143-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download

description	pid	process	target process
PID 1720 wrote to memory of 1804	1720	09d30f5e57629caacb86b013826ab1a2.exe	cmd.exe
PID 1720 wrote to memory of 1804	1720	09d30f5e57629caacb86b013826ab1a2.exe	cmd.exe
PID 1720 wrote to memory of 1804	1720	09d30f5e57629caacb86b013826ab1a2.exe	cmd.exe
PID 1720 wrote to memory of 3472	1720	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 1720 wrote to memory of 3472	1720	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 1720 wrote to memory of 3472	1720	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 1720 wrote to memory of 2416	1720	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 1720 wrote to memory of 2416	1720	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 1720 wrote to memory of 2416	1720	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 1804 wrote to memory of 3740	1804	cmd.exe	schtasks.exe
PID 1804 wrote to memory of 3740	1804	cmd.exe	schtasks.exe
PID 1804 wrote to memory of 3740	1804	cmd.exe	schtasks.exe
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe
PID 2416 wrote to memory of 3772	2416	09d30f5e57629caacb86b013826ab1a2.exe	09d30f5e57629caacb86b013826ab1a2.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads