meduza | 53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d

General

Target

clik.exe
Size

14.1MB
MD5

a2db986f46fc915b6b9b65d0d8b2c92f
SHA1

2aca2a24c33ea49c99365438cf4eee6c42fa73ed
SHA256

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d
SHA512

3e7346aba18a18c0e2fcb57baf2822cca67da175c8b7dfd675b1b5cd78092051e7443eac156a954297c16623f9c74cad4347ef015682282bec57fb056435652d
SSDEEP

393216:PXIJM3GodH2ThNzd4VQpier42zXfDmITsttRugNId:fUuozdshA4iXf/iuFd

Score

10^/10

meduza zgrat collection persistence rat stealer

Malware Config

Extracted

Family

meduza

C2

109.107.181.83

Signatures

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1236-10-0x000001DB4F710000-0x000001DB4F98E000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-11-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-26-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-24-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-20-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-38-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-46-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-70-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-68-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-74-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-72-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-66-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-64-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-62-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-60-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-58-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-56-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-54-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-52-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-50-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-48-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-44-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-42-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-40-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-36-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-34-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-32-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-30-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-28-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-18-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-16-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-14-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-12-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1236-22-0x000001DB4F710000-0x000001DB4F988000-memory.dmp	family_zgrat_v1
behavioral1/memory/1484-4925-0x0000000008ED0000-0x0000000009186000-memory.dmp	family_zgrat_v1

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3912-4902-0x0000000140000000-0x00000001400E9000-memory.dmp	family_meduza
behavioral1/memory/3912-8657-0x0000000140000000-0x00000001400E9000-memory.dmp	family_meduza

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 2 IoCs

Processes:

chalengesophisticated.exechallengesophisticated.exe

pid process

1236 chalengesophisticated.exe
1484 challengesophisticated.exe

pid	process
1236	chalengesophisticated.exe
1484	challengesophisticated.exe

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

clik.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	clik.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 api.ipify.org
36 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

chalengesophisticated.exe

description pid process target process

PID 1236 set thread context of 3912 1236 chalengesophisticated.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeInstallUtil.exe

pid process

3848 powershell.exe
3848 powershell.exe
3912 InstallUtil.exe
3912 InstallUtil.exe

flow	ioc
35	api.ipify.org
36	api.ipify.org

description	pid	process	target process
PID 1236 set thread context of 3912	1236	chalengesophisticated.exe	InstallUtil.exe

pid	process
3848	powershell.exe
3848	powershell.exe
3912	InstallUtil.exe
3912	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

chalengesophisticated.exepowershell.exechallengesophisticated.exe

description	pid	process
Token: SeDebugPrivilege	1236	chalengesophisticated.exe
Token: SeDebugPrivilege	1236	chalengesophisticated.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	1484	challengesophisticated.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

clik.exechalengesophisticated.exe

description	pid	process	target process
PID 1256 wrote to memory of 1236	1256	clik.exe	chalengesophisticated.exe
PID 1256 wrote to memory of 1236	1256	clik.exe	chalengesophisticated.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3912	1236	chalengesophisticated.exe	InstallUtil.exe
PID 1236 wrote to memory of 3848	1236	chalengesophisticated.exe	powershell.exe
PID 1236 wrote to memory of 3848	1236	chalengesophisticated.exe	powershell.exe
PID 1256 wrote to memory of 1484	1256	clik.exe	challengesophisticated.exe
PID 1256 wrote to memory of 1484	1256	clik.exe	challengesophisticated.exe
PID 1256 wrote to memory of 1484	1256	clik.exe	challengesophisticated.exe

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\clik.exe
"C:\Users\Admin\AppData\Local\Temp\clik.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:3912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe' -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
Filesize
14.5MB

MD5
66d0f556615ce40c851f1b7347773570

SHA1
5bf87f9716e522cf4f77a03fd7caa3ed94ad7882

SHA256
725e9172a1aafa7d2e4bdf37257df0d67f6c307035f7ad893a0bc5dad58dd199

SHA512
4a67a0173a3073b4b177a2e5d42dc62c8b3a5c159d82c73fa177f439880df14c6e7b7b2d8dec855b3fc0ceb7cb395d85cec40e5d5e31ebe8fa089e0e8282137f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
Filesize
16.4MB

MD5
aee8e83de9876ffaf39c78af9e288505

SHA1
5099fa9c38a612ed01b452bbfe36cd7c529deccc

SHA256
94e7120a4b7e58905de44f90abdce85f3ce97669249563ca50680dcecdd5bc7c

SHA512
1019222635fcf1b8477d19177e77dedbdbcac4eecf3bb096dc60204448eca653771fc33fb124bfb79e9bcf5d5de68a4fd61cf18d7dc8cbfc2e538aa4713e5ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmbi4ebf.4bl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1236-48-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-10-0x000001DB4F710000-0x000001DB4F98E000-memory.dmp

Filesize
2.5MB

Download
memory/1236-9-0x000001DB36410000-0x000001DB36420000-memory.dmp

Filesize
64KB

Download
memory/1236-40-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-42-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-26-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-24-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-20-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-38-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-46-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-70-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-68-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-74-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-72-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-66-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-64-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-62-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-60-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-58-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-56-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-54-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-52-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-50-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-8-0x00007FFCA9E60000-0x00007FFCAA921000-memory.dmp

Filesize
10.8MB

Download
memory/1236-44-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-11-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-7-0x000001DB33880000-0x000001DB34704000-memory.dmp

Filesize
14.5MB

Download
memory/1236-36-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-34-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-32-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-30-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-28-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-18-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-16-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-14-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-12-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-22-0x000001DB4F710000-0x000001DB4F988000-memory.dmp

Filesize
2.5MB

Download
memory/1236-4891-0x000001DB363F0000-0x000001DB363F1000-memory.dmp

Filesize
4KB

Download
memory/1236-4892-0x000001DB4ED30000-0x000001DB4EDEA000-memory.dmp

Filesize
744KB

Download
memory/1236-4893-0x000001DB36490000-0x000001DB364DC000-memory.dmp

Filesize
304KB

Download
memory/1236-4894-0x00007FFCA9E60000-0x00007FFCAA921000-memory.dmp

Filesize
10.8MB

Download
memory/1236-4895-0x000001DB36410000-0x000001DB36420000-memory.dmp

Filesize
64KB

Download
memory/1236-4897-0x000001DB4EFF0000-0x000001DB4F044000-memory.dmp

Filesize
336KB

Download
memory/1236-4903-0x00007FFCA9E60000-0x00007FFCAA921000-memory.dmp

Filesize
10.8MB

Download
memory/1484-4917-0x00000000002A0000-0x000000000130C000-memory.dmp

Filesize
16.4MB

Download
memory/1484-4924-0x0000000005C50000-0x0000000005CE2000-memory.dmp

Filesize
584KB

Download
memory/1484-4925-0x0000000008ED0000-0x0000000009186000-memory.dmp

Filesize
2.7MB

Download
memory/1484-4926-0x0000000009740000-0x0000000009CE4000-memory.dmp

Filesize
5.6MB

Download
memory/1484-9810-0x0000000005F50000-0x0000000006044000-memory.dmp

Filesize
976KB

Download
memory/3848-4916-0x000001AAFCE30000-0x000001AAFCE52000-memory.dmp

Filesize
136KB

Download
memory/3912-4902-0x0000000140000000-0x00000001400E9000-memory.dmp

Filesize
932KB

Download
memory/3912-8657-0x0000000140000000-0x00000001400E9000-memory.dmp

Filesize
932KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads