Overview

overview

10

Static

static

3

54632e7d37...7d.exe

windows7-x64

10

54632e7d37...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54632e7d37d3142474baff846284247d

  • Size

    812KB

  • Sample

    240111-x74lqaeffq

  • MD5

    54632e7d37d3142474baff846284247d

  • SHA1

    dfd39606a2dce9ffe5887f494d2cba0ee3c8bd22

  • SHA256

    dbe6359af1e119c871d0811f321e2ee4044eaf6ec65c68623937d096c197fe8c

  • SHA512

    0679ef0eb7b973cef0ebb94bc4e8b0eaf2e5a9ef587b4c54fe81dc984d762bda60266ba83da24bbd5cf9f42110f78b7850e3e4a5cdec8c88037734bf5ccd95ee

  • SSDEEP

    12288:2Pp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXMpJXfXUy/Wj:2Dpjtacljjy4OyJC+Ah+yFQzHm2G

Score
10/10
matiexcollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

matiex

Credentials

Targets

    • Target

      54632e7d37d3142474baff846284247d

    • Size

      812KB

    • MD5

      54632e7d37d3142474baff846284247d

    • SHA1

      dfd39606a2dce9ffe5887f494d2cba0ee3c8bd22

    • SHA256

      dbe6359af1e119c871d0811f321e2ee4044eaf6ec65c68623937d096c197fe8c

    • SHA512

      0679ef0eb7b973cef0ebb94bc4e8b0eaf2e5a9ef587b4c54fe81dc984d762bda60266ba83da24bbd5cf9f42110f78b7850e3e4a5cdec8c88037734bf5ccd95ee

    • SSDEEP

      12288:2Pp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXMpJXfXUy/Wj:2Dpjtacljjy4OyJC+Ah+yFQzHm2G

    Score
    10/10
    matiexcollectionkeyloggerspywarestealer

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks