meduza | b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe

Analysis

max time kernel
134s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe
Size

6.6MB
MD5

7cf0ba422c37585d399e4dffb0b7757c
SHA1

d7b1b39ccdb9287edbae0aa9496ab1d678a4780b
SHA256

b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe
SHA512

f28f438298954bdabfeb8848dcafe35e074b1750c32e9f01268e41ced8a2acac3e298159b85f159e9c9d4814f73ce2b89c1d8a8afc4a7a2ab30c2258dc3237c1
SSDEEP

196608:2UU5u4Ef30GhXdLPLPCiZMwVnvrgDK+Sshs:Z6FEvHdHC2M8vlEs

Score

10^/10

meduza zgrat rat stealer

Malware Config

Extracted

Family

meduza

109.107.181.83

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/1284-2-0x000000001C0B0000-0x000000001C326000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-3-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-4-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-8-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-6-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-10-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-14-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-12-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-18-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-22-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-20-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-26-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-28-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-30-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-32-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-36-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-38-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-42-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-44-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-48-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-50-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-52-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-56-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-58-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-60-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-64-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-66-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-62-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-54-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-46-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-40-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-34-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-24-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1
behavioral1/memory/1284-16-0x000000001C0B0000-0x000000001C320000-memory.dmp	family_zgrat_v1

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/1096-4906-0x0000000140000000-0x00000001400DA000-memory.dmp	family_meduza

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe
Token: SeDebugPrivilege	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1096	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	30
PID 1284 wrote to memory of 1620	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	31
PID 1284 wrote to memory of 1620	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	31
PID 1284 wrote to memory of 1620	1284	b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe	31

C:\Users\Admin\AppData\Local\Temp\b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe
"C:\Users\Admin\AppData\Local\Temp\b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe' -Force
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-4906-0x0000000140000000-0x00000001400DA000-memory.dmp

Filesize
872KB

Download
memory/1284-0-0x0000000001370000-0x0000000001A10000-memory.dmp

Filesize
6.6MB

Download
memory/1284-1-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1284-2-0x000000001C0B0000-0x000000001C326000-memory.dmp

Filesize
2.5MB

Download
memory/1284-3-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-4-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-8-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-6-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-10-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-14-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-12-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-18-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-22-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-20-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-26-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-28-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-30-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-32-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-36-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-38-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-42-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-44-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-48-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-50-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-52-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-56-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-58-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-60-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-64-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-66-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-62-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-54-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-46-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-40-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-34-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-24-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-16-0x000000001C0B0000-0x000000001C320000-memory.dmp

Filesize
2.4MB

Download
memory/1284-2900-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1284-4884-0x000000001B400000-0x000000001B480000-memory.dmp

Filesize
512KB

Download
memory/1284-4885-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1284-4886-0x0000000000A70000-0x0000000000B22000-memory.dmp

Filesize
712KB

Download
memory/1284-4887-0x0000000000860000-0x00000000008AC000-memory.dmp

Filesize
304KB

Download
memory/1284-4888-0x000000001B400000-0x000000001B480000-memory.dmp

Filesize
512KB

Download
memory/1284-4890-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/1284-4891-0x000000001B360000-0x000000001B3B4000-memory.dmp

Filesize
336KB

Download
memory/1284-4907-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/1284-4905-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1620-4912-0x000000001B3B0000-0x000000001B692000-memory.dmp

Filesize
2.9MB

Download
memory/1620-4913-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/1620-4914-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1620-4915-0x0000000002B50000-0x0000000002BD0000-memory.dmp

Filesize
512KB

Download
memory/1620-4916-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1620-4917-0x0000000002B50000-0x0000000002BD0000-memory.dmp

Filesize
512KB

Download
memory/1620-4918-0x0000000002B50000-0x0000000002BD0000-memory.dmp

Filesize
512KB

Download
memory/1620-4919-0x0000000002B50000-0x0000000002BD0000-memory.dmp

Filesize
512KB

Download
memory/1620-4935-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download