matiex | 5ed1ca31300cdef81d6bbbba39924b2a6b163d49a124f6f0a3bc997b122aba62

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order - Avicorp Middle East.exe
Size 730KB
Sample260910-ajma7sbp9x
SHA256 5ed1ca31300cdef81d6bbbba39924b2a6b163d49a124f6f0a3bc997b122aba62
MD5 a049a1ba8f02643309f08baae4fc05b3
SHA1 6dc3536902de41881b128f9e2506599d0063d355
SHA512 533793c1196983ee3aaaedc238ea575039e0eff1fe9580a50d73e00da3a25caa903c51bb20a3f3e96567ffc6e21eedeee64536141a4cc205340f069d83babc8a
SSDEEP 6144:RppZaEHpEnOISylvdar7YY6/oJhc4boXYI8edrbmUm/4O8b8ITDnlznZDG0:PJxVn6/onTiYaBbvm/4O8b8ITDnl
TLSH
T102F4B43262F9C2C0C1647576CD67BAF02251ED96C9A08E0F3D4A7F597A722A0FD3960D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution matiex keylogger persistence stealer

Malware Config

Extracted

Family

matiex

Credentials

Protocol
smtp
Host
avicorrpinc.com
Port
587
Username
[email protected]
Password
efJ8Vug2uu8M
Email to
[email protected]

Signatures

Family: Matiex
Matiex is a keylogger and infostealer first seen in July 2020.
stealer keylogger matiex

Matiex Main payload 1 IoCs

resource	yara_rule
behavioral2/memory/2360-23-0x0000000000400000-0x0000000000472000-memory.dmp	family_matiex

Executes dropped EXE 2 IoCs

pid	Process
5772	AVAST.exe
2864	AVAST.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAST = "C:\\Users\\Admin\\AppData\\Roaming\\AVAST.exe"	reg.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org
1	freegeoip.app
14	freegeoip.app
16	freegeoip.app

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5772 set thread context of 2360	5772	AVAST.exe	99
PID 2864 set thread context of 1088	2864	AVAST.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3436	cmd.exe
4780	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5956	1088	WerFault.exe	102
5676	2360	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AVAST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AVAST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Order - Avicorp Middle East.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2064	New Order - Avicorp Middle East.exe
5772	AVAST.exe
2864	AVAST.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	New Order - Avicorp Middle East.exe
Token: SeDebugPrivilege	5772	AVAST.exe
Token: SeDebugPrivilege	2864	AVAST.exe
Token: SeDebugPrivilege	2360	InstallUtil.exe
Token: SeDebugPrivilege	1088	InstallUtil.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3436	2064	New Order - Avicorp Middle East.exe	90
PID 2064 wrote to memory of 5048	2064	New Order - Avicorp Middle East.exe	93
PID 5048 wrote to memory of 5772	5048	cmd.exe	95
PID 5772 wrote to memory of 4780	5772	AVAST.exe	96
PID 4780 wrote to memory of 5448	4780	cmd.exe	98
PID 5772 wrote to memory of 2360	5772	AVAST.exe	99
PID 5772 wrote to memory of 2360	5772	AVAST.exe	99
PID 5772 wrote to memory of 2360	5772	AVAST.exe	99
PID 5772 wrote to memory of 2360	5772	AVAST.exe	99
PID 5772 wrote to memory of 2360	5772	AVAST.exe	99
PID 2864 wrote to memory of 1088	2864	AVAST.exe	102
PID 2864 wrote to memory of 1088	2864	AVAST.exe	102
PID 2864 wrote to memory of 1088	2864	AVAST.exe	102
PID 2864 wrote to memory of 1088	2864	AVAST.exe	102
PID 2864 wrote to memory of 1088	2864	AVAST.exe	102

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\New Order - Avicorp Middle East.exe
"C:\Users\Admin\AppData\Local\Temp\New Order - Avicorp Middle East.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\New Order - Avicorp Middle East.exe" "C:\Users\Admin\AppData\Roaming\AVAST.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\AVAST.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Roaming\AVAST.exe
    "C:\Users\Admin\AppData\Roaming\AVAST.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "AVAST" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AVAST.exe"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4780
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "AVAST" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AVAST.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5448
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:2360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 1092
        5⤵
        Program crash
        
        PID:5676

C:\Users\Admin\AppData\Roaming\AVAST.exe
C:\Users\Admin\AppData\Roaming\AVAST.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 2040
    3⤵
    - Program crash
    PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1088 -ip 1088
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2360 -ip 2360
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AVAST.exe

Path C:\Users\Admin\AppData\Roaming\AVAST.exe
Size 730KB
SHA256 5ed1ca31300cdef81d6bbbba39924b2a6b163d49a124f6f0a3bc997b122aba62
MD5 a049a1ba8f02643309f08baae4fc05b3
SHA1 6dc3536902de41881b128f9e2506599d0063d355
SHA512 533793c1196983ee3aaaedc238ea575039e0eff1fe9580a50d73e00da3a25caa903c51bb20a3f3e96567ffc6e21eedeee64536141a4cc205340f069d83babc8a
SSDEEP 6144:RppZaEHpEnOISylvdar7YY6/oJhc4boXYI8edrbmUm/4O8b8ITDnlznZDG0:PJxVn6/onTiYaBbvm/4O8b8ITDnl
TLSH
T102F4B43262F9C2C0C1647576CD67BAF02251ED96C9A08E0F3D4A7F597A722A0FD3960D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-12-0x0000000008A70000-0x0000000008A92000-memory.dmp

Download

memory/2064-8-0x0000000002890000-0x000000000289C000-memory.dmp

Download

memory/2064-3-0x0000000004E40000-0x0000000004E60000-memory.dmp

Download

memory/2064-4-0x0000000007430000-0x0000000007454000-memory.dmp

Download

memory/2064-5-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download

memory/2064-6-0x0000000007CA0000-0x000000000825A000-memory.dmp

Download

memory/2064-7-0x00000000077E0000-0x0000000007872000-memory.dmp

Download

memory/2064-14-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download

memory/2064-9-0x0000000007980000-0x00000000079E6000-memory.dmp

Download

memory/2064-10-0x0000000008AF0000-0x0000000008CB2000-memory.dmp

Download

memory/2064-11-0x00000000091F0000-0x000000000971C000-memory.dmp

Download

memory/2064-0-0x0000000074CF2000-0x0000000074CF3000-memory.dmp

Download

memory/2064-2-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Download

memory/2064-15-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download

memory/2064-13-0x0000000074CF2000-0x0000000074CF3000-memory.dmp

Download

memory/2064-1-0x0000000000320000-0x00000000003DC000-memory.dmp

Download

memory/2360-23-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/2864-24-0x0000000005A10000-0x0000000005A34000-memory.dmp

Download

memory/2864-26-0x00000000095D0000-0x00000000095E2000-memory.dmp

Download

memory/5772-18-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download

memory/5772-19-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download

memory/5772-20-0x0000000009F60000-0x0000000009F72000-memory.dmp

Download

memory/5772-21-0x0000000009FA0000-0x0000000009FC2000-memory.dmp

Download

memory/5772-17-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download

memory/5772-25-0x0000000074CE0000-0x000000007549C000-memory.dmp

Download