meduza | 0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d

General

Target

0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe
Size

4.1MB
MD5

c3e44b324eb2145c756c3e5de7b4defb
SHA1

150238e4629d6941f95d1ab7a6e84897e5bbabd9
SHA256

0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d
SHA512

2776571ddd9b023b8452c2e892505607a83aab44c88031e440cb6e099e48d3f22e488c640e662086a83cf7801c23f24547d00e3010cae2cf2111e912a2618047
SSDEEP

49152:xXmM3+IVJiicn3HpKoQyvf7+MsgFYengla6MuBWcywgSzLXduCtr8U:KdVjnaJ8dwWTwgSlf

Score

10^/10

meduza collection stealer

Malware Config

Extracted

Family

meduza

C2

5.182.86.229

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4152-0-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral2/memory/4152-1-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral2/memory/4152-2-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral2/memory/4152-3-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza
behavioral2/memory/4152-12-0x0000000140000000-0x00000001400D3000-memory.dmp	family_meduza

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
8	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	wab.exe
4152	wab.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 1552 wrote to memory of 4152	1552	0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe	86
PID 4152 wrote to memory of 960	4152	wab.exe	91
PID 4152 wrote to memory of 960	4152	wab.exe	91
PID 960 wrote to memory of 8	960	cmd.exe	94
PID 960 wrote to memory of 8	960	cmd.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe

C:\Users\Admin\AppData\Local\Temp\0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe
"C:\Users\Admin\AppData\Local\Temp\0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files\Windows Mail\wab.exe
  "C:\Program Files\Windows Mail\wab.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4152
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Program Files\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4152-0-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/4152-1-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/4152-2-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/4152-3-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download
memory/4152-12-0x0000000140000000-0x00000001400D3000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing