Kematian Info Stealer: Infrastructure Map & IOCs to Block

Overview

Kematian is an info‑stealer that targets credentials, cookies, and local artifacts to support espionage and fraud. This post maps the attacker infrastructure in a service‑oriented view and provides a concise, copy‑ready table of high‑confidence Indicators of Compromise (IOCs) to block and monitor. Use these IOCs immediately at your perimeter and endpoint controls to reduce exposure.

High‑level infrastructure map

Represent each component below as a labeled node in your infrastructure diagram: role, typical behaviors, and where to apply controls.

1. Delivery & Initial Access

• Vectors: phishing emails, malicious attachments, trojanized archives, or social‑engineered downloads.
• Typical delivery artifacts: batch files, downloader stubs, or malicious scripts.

2. Loader / Dropper

• Lightweight downloader (Loader) writes disk artifacts and fetches the main payload.
• Common techniques: encoded PowerShell, scripted downloaders (.bat, .ps1).

3. Kematian Info Stealer (Payload)

Main executable (Main.exe) executes collection routines:

Browser cookies, stored passwords, autofill data
Authentication tokens, local app configs
System and network metadata
May perform process injection or script‑based execution for stealth.

4. Injection & In‑memory Activity

Scripts such as Injection.js or PowerShell stagers perform code injection, in‑memory unpacking, or reflective loading to minimize disk footprint.

5. Command & Control (C2)

• Beacons to C2 endpoints for tasking and exfiltration; often over HTTPS or via encoded HTTP(s) POSTs.
• C2 infrastructure may rotate domains and IPs; blocking known endpoints reduces exfiltration success.

6. Exfiltration & Cleanup

Staged data exfiltration to C2, sometimes compressing or encrypting artifacts prior to upload.
Cleanup routines attempt to remove obvious artifacts; memory captures are crucial for forensics.

Prioritized IOCs to block

Actions

Ingest the hashes into EDR/AV blocklists and quarantine any matching files.
Block execution of the listed filenames via application control policies where feasible.
Add DNS/URL/IP blocks if you have telemetry for associated C2 domains or addresses.

Detection & hunting guidance

Network

• Alert on outbound HTTPS/HTTP POST traffic from endpoints with unusual User‑Agents or to newly observed domains.
• Monitor for repeated small encrypted POSTs or beacon intervals from endpoints.

Endpoint

Hunt for executions of the listed filenames in %Temp%, %AppData%, and user profile directories.
Look for parent/child anomalies (e.g., explorer.exe or mshta.exe spawning PowerShell, JS, or unknown EXEs).
Detect process injection patterns and reflective DLL loads. Memory capture will reveal unpacked payloads and C2 strings.

Logs to collect

• EDR telemetry (process creation, file writes, network connections)
• Sysmon (process, network, file create, and registry events)
• Email gateway logs (to track potential phishing delivery)
• Proxy/DNS logs (to identify C2 lookups)

Forensic collection checklist

If you suspect compromise:

1. Isolate the host but preserve volatile state.
2. Capture full memory dump (reveals injected modules, in‑memory strings and credentials).
3. Collect relevant files: the files listed above (if present), scheduled task XML, registry autorun keys, and user profile artifacts.
4. Export EDR process and network telemetry; capture PCAP if possible.
5. Preserve browser profiles and cookie stores for recovery/hunt.

Recommended immediate mitigations

• Block and quarantine the listed hashes at EDR/AV.
• Configure application allow‑listing and prevent execution from common drop paths (%Temp%, downloads).
• Enforce MFA for all remote and high‑value accounts to limit value of stolen credentials.
• Harden email gateway: enable attachment sandboxing and block known malicious file types by default.
• Enable centralized logging (Sysmon + EDR) and retain logs long enough to investigate multi‑stage intrusions.
• Educate users to treat unexpected attachments or downloads with suspicion and report them.

How we can help

We provide:

• Full IOC ingestion packages (CSV/JSON) for SIEM/EDR.
• Tailored detection rules and hunting queries for your tooling.
• Incident response and memory forensics to recover sensitive artifacts and assess scope.