matiex | f6d1fef78457a6ba54a7935e9b709c97f73a8f65e82e0a69e84942aac6f5c5cb

General

Target

45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe
Size

1.1MB
MD5

45c94cdf9e3047f2b6285847c54c8016
SHA1

41043b93ab918961cdf54d28b312f6daa48876bd
SHA256

f6d1fef78457a6ba54a7935e9b709c97f73a8f65e82e0a69e84942aac6f5c5cb
SHA512

5cf219f642be5e1b20a51446de0ad892d7a5f3c4a0a69e977231ae182db6be16cf4c9bbea5d431df5cf7a23279e8b218af9b63397cb787ccd9445356e7466b1d
SSDEEP

12288:TWDag5UEjqfu19dtRyXbsK3oNWAiai/XpfVM7mypq6OBtqKuCwaBuomAGd+mVK9j:R2dda2kai/XvCmp6OBtq9ZaRdH

Score

10^/10

matiex collection keylogger stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol: smtp
Host:
mail.cleo2solutions.com.au
Port:
25
Username:
[email protected]
Password:
Enter@123

Signatures

Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main payload 5 IoCs

resource	yara_rule
behavioral1/memory/2884-22-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2884-20-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2884-18-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2884-14-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex
behavioral1/memory/2884-12-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2884	WerFault.exe	32

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe
2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe
2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe
Token: SeDebugPrivilege	2884	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2948	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2948	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2948	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2948	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2884	2964	45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe	32
PID 2884 wrote to memory of 2416	2884	RegSvcs.exe	34
PID 2884 wrote to memory of 2416	2884	RegSvcs.exe	34
PID 2884 wrote to memory of 2416	2884	RegSvcs.exe	34
PID 2884 wrote to memory of 2416	2884	RegSvcs.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45c94cdf9e3047f2b6285847c54c8016_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XVhumiX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp500.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1120
    3⤵
    - Program crash
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp500.tmp

Filesize
1KB

MD5
8a559323031db87667d99824dfa5f932

SHA1
56ff8cce8d6d1c4daa4fc7a5b366c2f1d047fb8a

SHA256
443e1343383ff4297e0a859fd6a80c63f004362dd09698435be8e9d2613ab586

SHA512
f45f2994cf82848c6e3da63cada2eb217bb4b758e44c39bdbe67a4e6ff0e4e136e4d48fa10d693d5cefb44ce2b3f98a9b2bd76c4cb31996571c33b4751d3c07b

Download Submit
memory/2884-12-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2884-14-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2884-22-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2884-20-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2884-25-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2884-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-10-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2884-23-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-26-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2964-3-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/2964-1-0x00000000012D0000-0x00000000013FA000-memory.dmp

Filesize
1.2MB

Download
memory/2964-2-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-0-0x000000007427E000-0x000000007427F000-memory.dmp

Filesize
4KB

Download
memory/2964-6-0x0000000007DF0000-0x0000000007E82000-memory.dmp

Filesize
584KB

Download
memory/2964-24-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-5-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-4-0x000000007427E000-0x000000007427F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads