meduza | 0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d

General

Target

0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe
Size

4.1MB
MD5

c3e44b324eb2145c756c3e5de7b4defb
SHA1

150238e4629d6941f95d1ab7a6e84897e5bbabd9
SHA256

0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d
SHA512

2776571ddd9b023b8452c2e892505607a83aab44c88031e440cb6e099e48d3f22e488c640e662086a83cf7801c23f24547d00e3010cae2cf2111e912a2618047
SSDEEP

49152:xXmM3+IVJiicn3HpKoQyvf7+MsgFYengla6MuBWcywgSzLXduCtr8U:KdVjnaJ8dwWTwgSlf

Score

10^/10

meduza collection stealer

Malware Config

Extracted

Family

meduza

C2

5.182.86.229

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 9 IoCs

resource	yara_rule
behavioral1/memory/1352-3-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-5-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-6-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-7-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-4-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-9-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-11-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-12-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral1/memory/1352-28-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3056	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1352	csc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 2900 wrote to memory of 1352	2900	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	29
PID 1352 wrote to memory of 2352	1352	csc.exe	31
PID 1352 wrote to memory of 2352	1352	csc.exe	31
PID 1352 wrote to memory of 2352	1352	csc.exe	31
PID 2352 wrote to memory of 3056	2352	cmd.exe	33
PID 2352 wrote to memory of 3056	2352	cmd.exe	33
PID 2352 wrote to memory of 3056	2352	cmd.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	csc.exe

C:\Users\Admin\AppData\Local\Temp\0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe
"C:\Users\Admin\AppData\Local\Temp\0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1352
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-0-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-1-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-3-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-2-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-5-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-6-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-7-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-4-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-8-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

Filesize
4KB

Download
memory/1352-9-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-11-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-12-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/1352-28-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing