matiex | 0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9

General

Target

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Size

715KB
MD5

0b52424adb115b1336d084cf0cfbb73e
SHA1

084e85f67c1743bc12a6bdea960a3fd34025cf51
SHA256

0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9
SHA512

4e162fdb73d382a85959c613cce961424e50e1b524b36ce82bfb44cd4f0f00ae547f84ab52201c9fa88d9f70e1a36c81635808895d8b7e1ab7d47f6ab1cca95c
SSDEEP

12288:RDhxrUNCKpoxLfz7SzJHtODOWFg3W/jwG4cxxPtUU+GwGp:xWCcoxjqJHt0Hg3ijwJ4z+Sp

Score

10^/10

matiex collection keylogger spyware stealer

Malware Config

Extracted

Family

matiex

C2

https://api.telegram.org/bot1327331385:AAFaAF38_aAo1cyYYTIEnuc9sIJxwBlO_i4/sendMessage?chat_id=1055082792

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2844-8-0x00000000051B0000-0x0000000005222000-memory.dmp	family_matiex
behavioral1/memory/2772-19-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2772-21-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2772-14-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2772-13-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2772-17-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2772-24-0x0000000001010000-0x0000000001050000-memory.dmp	family_matiex
behavioral1/memory/2772-26-0x0000000001010000-0x0000000001050000-memory.dmp	family_matiex

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
16 freegeoip.app

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app
16	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

description	pid	process	target process
PID 2844 set thread context of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2336 2772 WerFault.exe 0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

pid	pid_target	process	target process
2336	2772	WerFault.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
Token: SeDebugPrivilege	2772	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

description	pid	process	target process
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2844 wrote to memory of 2772	2844	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
PID 2772 wrote to memory of 2336	2772	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	WerFault.exe
PID 2772 wrote to memory of 2336	2772	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	WerFault.exe
PID 2772 wrote to memory of 2336	2772	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	WerFault.exe
PID 2772 wrote to memory of 2336	2772	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

outlook_win_path 1 IoCs

Processes:

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 1276
    3⤵
    - Program crash
    PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-13-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2772-14-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2772-9-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2772-21-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2772-25-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2772-24-0x0000000001010000-0x0000000001050000-memory.dmp

Filesize
256KB

Download
memory/2772-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-17-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2772-23-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2772-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2772-26-0x0000000001010000-0x0000000001050000-memory.dmp

Filesize
256KB

Download
memory/2772-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2844-6-0x0000000000B00000-0x0000000000B62000-memory.dmp

Filesize
392KB

Download
memory/2844-22-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-8-0x00000000051B0000-0x0000000005222000-memory.dmp

Filesize
456KB

Download
memory/2844-0-0x0000000001070000-0x0000000001128000-memory.dmp

Filesize
736KB

Download
memory/2844-2-0x0000000000FC0000-0x0000000001000000-memory.dmp

Filesize
256KB

Download
memory/2844-7-0x0000000004E00000-0x0000000004E74000-memory.dmp

Filesize
464KB

Download
memory/2844-1-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-5-0x0000000000FC0000-0x0000000001000000-memory.dmp

Filesize
256KB

Download
memory/2844-4-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-3-0x00000000002E0000-0x00000000002F2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads