meduza | 907706946fe86a55bf29fefb4e5d2d0f0f490bd1b565cb39bdf8daad60acabfc

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.2MB
Sample240403-s5bqpsfd59
SHA256 907706946fe86a55bf29fefb4e5d2d0f0f490bd1b565cb39bdf8daad60acabfc
MD5 8e42154340d1bbc53124f99ba0c32f4c
SHA1 040ab2d5c10313dbc2a90bea01e7be35be26e533
SHA512 bd32fb25575d90a0bc7f9e79c6dec2fcf0874f9be630cb71d438b267e03d28b37d085e0a24b19b325ae0801a8f4f50626c428b464c703aebefad976c23be7ff2
SSDEEP 24576:vfLGjUJ+7ewtyRYd41pdz8Z7tmvZZCEP9cEeGcMo0cHTCPTEFhEOsDObVCAih:nUsCegqgZBmZZCEVKGcM0zCLyhJsAKh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2976-31-0x000002444CE90000-0x000002444CF63000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	Downloading.pif

Executes dropped EXE 2 IoCs

pid	Process
2364	Downloading.pif
2976	Downloading.pif

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	api.ipify.org
45	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4224	tasklist.exe
4276	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3608	PING.EXE
3124	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif
2976	Downloading.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1328	4736	file.exe	96
PID 4736 wrote to memory of 1328	4736	file.exe	96
PID 4736 wrote to memory of 1328	4736	file.exe	96
PID 1328 wrote to memory of 4224	1328	cmd.exe	99
PID 1328 wrote to memory of 4224	1328	cmd.exe	99
PID 1328 wrote to memory of 4224	1328	cmd.exe	99
PID 1328 wrote to memory of 4216	1328	cmd.exe	100
PID 1328 wrote to memory of 4216	1328	cmd.exe	100
PID 1328 wrote to memory of 4216	1328	cmd.exe	100
PID 1328 wrote to memory of 4276	1328	cmd.exe	104
PID 1328 wrote to memory of 4276	1328	cmd.exe	104
PID 1328 wrote to memory of 4276	1328	cmd.exe	104
PID 1328 wrote to memory of 1432	1328	cmd.exe	105
PID 1328 wrote to memory of 1432	1328	cmd.exe	105
PID 1328 wrote to memory of 1432	1328	cmd.exe	105
PID 1328 wrote to memory of 884	1328	cmd.exe	106
PID 1328 wrote to memory of 884	1328	cmd.exe	106
PID 1328 wrote to memory of 884	1328	cmd.exe	106
PID 1328 wrote to memory of 4752	1328	cmd.exe	107
PID 1328 wrote to memory of 4752	1328	cmd.exe	107
PID 1328 wrote to memory of 4752	1328	cmd.exe	107
PID 1328 wrote to memory of 4548	1328	cmd.exe	108
PID 1328 wrote to memory of 4548	1328	cmd.exe	108
PID 1328 wrote to memory of 4548	1328	cmd.exe	108
PID 1328 wrote to memory of 3196	1328	cmd.exe	109
PID 1328 wrote to memory of 3196	1328	cmd.exe	109
PID 1328 wrote to memory of 3196	1328	cmd.exe	109
PID 1328 wrote to memory of 2364	1328	cmd.exe	110
PID 1328 wrote to memory of 2364	1328	cmd.exe	110
PID 1328 wrote to memory of 3608	1328	cmd.exe	112
PID 1328 wrote to memory of 3608	1328	cmd.exe	112
PID 1328 wrote to memory of 3608	1328	cmd.exe	112
PID 2976 wrote to memory of 3920	2976	Downloading.pif	119
PID 2976 wrote to memory of 3920	2976	Downloading.pif	119
PID 3920 wrote to memory of 3124	3920	cmd.exe	121
PID 3920 wrote to memory of 3124	3920	cmd.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Downloading.pif

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c move Sword Sword.bat && Sword.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 496054
    3⤵
    PID:884
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "ExplainedApSegaWants" Buck
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 496054\Downloading.pif + Kirk + Resume + Environmental + Adjust + Optimal 496054\Downloading.pif
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Move + W + Skype + Besides + Winds 496054\L
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\496054\Downloading.pif
    496054\Downloading.pif 496054\L
    3⤵
    - Executes dropped EXE
    PID:2364
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3608

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\496054\Downloading.pif
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\496054\Downloading.pif
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\496054\Downloading.pif"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Downloading.pif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\496054\Downloading.pif
Size 990KB
SHA256 e528c2a6706b5ad536c7d5b745fbb037ae5ed197df4d687321eeb119c60007b3
MD5 7e778aecb67efac6252d3664087209e3
SHA1 e710316dae046e32f9011cabd2b68342a0d02626
SHA512 b459f0dd30d70eadadf79e52dfa97e186fb9a679d37c5c03cde23671fe28b987a8505e519b7586893c6b8728365f295c2aaf98794013301c2cc907feb349d65e
SSDEEP 12288://RSlbQydQowbvuXJN6VDBYQql5o4wFT15KLf56SuhMeqCPKSnVKqOraVrdHfX5s:3RSKcQowaN69BegScM0Qr6BqW9gaC8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adjust

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Adjust
Size 136KB
SHA256 096c03a100040e3aa18471b45cb8676cffa084e14048ff25e2baa3b9ee6be286
MD5 5f998222206b54a015de203d50013919
SHA1 0f0c03ee1d535c5ab9a11f7b0cb0fd0cd17f3250
SHA512 56d2b681e4f6bf116907b9e56b30851f56580018fb07ea5c1646eb8c78a01d367c0f9a048321abc8e57f53a76b164f6ee10259a70bc3396efe110bbe53a713cc
SSDEEP 1536:NsW4dIsTu9aAwueAUPxKfi6JfTcQdAOxXPlAk:yViaAteAUPx6RXPGk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Besides

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Besides
Size 245KB
SHA256 c5562d70a3486e40af0d77231324f6415383b676cd37d2be60a52f3066d159c4
MD5 e6f59e2d5eb54747cf837c35e9df9fe3
SHA1 d9ad2413360d2acc0b3a23b959a927a3530f3462
SHA512 79939286d29c420460dc16a0c92947fa7f02d7cf74b342e7545224c61b9c630815320a1d7a75d075cb0f96fbcfcb6e242e60ea7fbd66c9a86a42a09f60f4b497
SSDEEP 3072:mXARFDFnzNfy7RMGDePAUsM5N/8RHWVvUF5k5C4F9+kP6MTx0:mw71NMrDuANM5N/8RHW+FW/9CCx0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Buck

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Buck
Size 50B
SHA256 4f8b24e2a41f06385a217d2cf3ba9118e3c9ff2e1af4898f8818ab6b4b47d608
MD5 6268ac4040c9c50d6cc138f00d1ff031
SHA1 b0474a799086ad83f26ac4c94990b18f791e58ab
SHA512 fca29346189cbe532c740ac2af77f270a76e7e0239c81f1af13421846c5396ea69b2f19e31e5554e3803b2a15a9f0d84a28a160d0d62150570fce29fc180407f
MD5 SHA1 SHA512

Submit Download

Environmental

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Environmental
Size 298KB
SHA256 6bb78419c4697b5287cf6f9b31d66357ee7a907c8b432a097bebb5f6bad403dc
MD5 bfd5e0f0435f2984613b57209faefb96
SHA1 57d35bf49135e2e552453a983a0bd3bab1c2b93f
SHA512 7ebefa19f63074445066c30722090eb553f095bdbbf7b31b1334a8fb539de7f4818167987115ba1485d1f3e834490ea45866d42549b25882548cf03cdd9ef108
SSDEEP 6144:sChNuqcxN4QVtKSnVKYUWOtci/aVrdHfX5bZYalrISe6HKfPeohX:xeqCPKSnVKqOraVrdHfX5bZPrNHaWoh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kirk

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Kirk
Size 226KB
SHA256 78cb40e0df6752c4454168d11f4af632825d95aeaf2901b475549b8fa6e860e7
MD5 80e5c12559f7db2eff61d9c75d8916ed
SHA1 f6010cb54f65f2fd781bbcac052581ba5eac3bc5
SHA512 ab34f30f4d157398d172e1fc6cd68625150f6781ee7bd9cb803d3e09248aea52339be30161ff1ad38a33624391087307a1b06fa270a719dd8b3e5785e7248fc0
SSDEEP 3072:xhBaQ5h+Roc0UPSmadFLH7Jv8tlTc7PvuaaxabyTR0WtP58/wMW4xTLIKQLJsvPS:xP60dPLH7JSleLaxQydPP5KKATbQLivq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Move

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Move
Size 290KB
SHA256 a2f1a59c5715117971c921258f1ee3f0d065dd695810c4924e150a518b02a437
MD5 e315eec0df8fa4518bcea1a2d74e75c8
SHA1 81e7cf34cb69e2196dd60ca0eb8ad9d7b1c8a2c6
SHA512 745187fb15036640fa6e9b1bcc163a985ee774e84580fdd2c76e89a7546c9ccbbf8d18e8706dd215cf20d3be77c78ae22af06a204e75c1fe937ae21901729560
SSDEEP 3072:n21UpOPbnA3jJamkna+ubHFZ4cKhPQmbKdQwkOu4IUoUC4DTGE:2OpOPb8Imt+yHrnhwOf1VCYx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Optimal

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Optimal
Size 131KB
SHA256 2cac89fb2c6f1153b8a9e824e7e934fbb969c01f626fbaf65d3411d9e8b4c962
MD5 f72ea29a6ba0b7ba31239d5555f8d4c0
SHA1 1859148e0396f7d1c97212f825fd412ae311e589
SHA512 53131d9137dd357ab0c0d09db1ac19698bd604b3f70f08b37bca9d9599f77f2abe205104ab2ed00f163736f104e6233ac54aba7c9d57ad944fb2b9412a0a9765
SSDEEP 1536:UELxsnBgarS9atzPIGfAwmrnN3EfrDWyu0uZo2+9B9a:UELx6BgarSMtQGVenNaWy4ZNo9a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resume

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Resume
Size 199KB
SHA256 08d11b731018d74681d829202e8926ed547023aaeea764bb3d6f426f2e531883
MD5 d36c9e3b7c98f094f3a3a2026c7f5d40
SHA1 bcbc3b22b164146ae8a108c256211114cd557524
SHA512 abf4a4d02455ceb0f7df0f9654c72f5539cf60e7f5fae0efca309927576a1f229713c5918fd2c2ccb8c2c3757d22463bdedda3742ecd4b093ad1e2a7309d31b2
SSDEEP 6144:ch820nOG7V5n6qKDBYJAxI0kuql5o4wFT15KLf59dQ7SucwQ:cvuXJN6VDBYQql5o4wFT15KLf56SuhQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Skype

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Skype
Size 266KB
SHA256 12c7a7d489c0c2032fd37edaf8c0616e4ff44e0d2f6ed0b9ebdae834d262d764
MD5 74c926a03678fbdb41d0b347e9968f54
SHA1 3e20927c48eaa226aff887fd199a109cc268d846
SHA512 4cbf5c2f64e9c2826ebf5cbdb97e03d55dde7470a95e7aac2f80e3e98bd4606f9b97b368c3229c4a4a1014a55c905480aaf32a748f48c1c24b0632de584f0d06
SSDEEP 3072:cXS1YNuXjTchZP7Ho0Svd7OktxIpjRbAKLw4WqW1rvGJYPfMa:cC1SuzTgo0SvVfqpjRAKE4W7NMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sword

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sword
Size 19KB
SHA256 f6238ef450cbf68796a99593c18eb1e64d359263c77baf4aec1acb942fe808ee
MD5 79dabe9b028f94d9af71be6224b0a58f
SHA1 ae6c5eebe69bc60d4a55ca30e08a5a8ddb4feb5e
SHA512 3d5680d18e86a66f4e430b5de76c6d73114328ea2ef59b98f0d1c69fc746bf1c4ad45850db14172fa9936e51566cd13c413a63bf830f884ef919cdef2cdd5743
SSDEEP 384:Pf/7BZ3+A1toYTLD0H+jsMGGmnYB+/U0urFIzMR/eYaVTJgZ/PbQ:vX+MV8HqsMtme4U0gIzMRAHgZU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\W
Size 252KB
SHA256 80810fa392f77775e1415507bde2a6c7a3a18cc442494db47e089c64886694d8
MD5 38c9e1bcc01e87e599cac5a8772bf25e
SHA1 35abdd6e42088e131d0151a3027c634932322b50
SHA512 f154380b9ca0059342d705b35b97e246d87e82ae63491fdfea32a399f3b6c89d56fd46bbabb9e00ccf32e1d0afbdacc84cec9581ba2e4acd69ce62991c33bb8d
SSDEEP 3072:Gzm1fbhvr0GPS07Ge00f3m12n8B47sbWzdM:GzubhvDPS0amf3vn8C7syzdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Winds

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Winds
Size 223KB
SHA256 ddef45c206e72ac0ab26c1793cfd8bb8f2c34ca6acc7f3bdc196b0fc2ddcf04a
MD5 3ea30d6c00dee320fab47266261cc4d4
SHA1 c4b062d349ea502580c2b846e2a3dcce0ad19985
SHA512 d5ec23930a5519e4f92c28a89bd15caca219f12c1d10ff1377a2e519fa5121598bd5bb23e0f3121e2684a68d325329715c686979c7e323e919afa502dcedaf2a
SSDEEP 3072:4MmMyrpULlhJLLwpOmvLsncz6zFzQXLgDIF/d8:4MmMopOmvLxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2976-31-0x000002444CE90000-0x000002444CF63000-memory.dmp

Download