meduza | 1f8e7cf27e00b7f9b1e55daca0a909158d0e4f250cdabc8ef59d86d8659f3356

General

Target

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe
Size

14.1MB
MD5

a2db986f46fc915b6b9b65d0d8b2c92f
SHA1

2aca2a24c33ea49c99365438cf4eee6c42fa73ed
SHA256

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d
SHA512

3e7346aba18a18c0e2fcb57baf2822cca67da175c8b7dfd675b1b5cd78092051e7443eac156a954297c16623f9c74cad4347ef015682282bec57fb056435652d
SSDEEP

393216:PXIJM3GodH2ThNzd4VQpier42zXfDmITsttRugNId:fUuozdshA4iXf/iuFd

Score

10^/10

meduza zgrat collection persistence rat stealer

Malware Config

Extracted

Family

meduza

C2

109.107.181.83

Signatures

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2160-10-0x000002569DFF0000-0x000002569E26E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-20-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-32-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-36-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-34-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-30-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-28-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-24-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-22-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-26-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-16-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-14-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-11-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-18-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-12-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-46-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-60-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-62-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-68-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-74-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-72-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-64-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-58-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-56-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-54-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-70-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-66-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-52-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-50-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-48-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-44-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-42-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-40-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2160-38-0x000002569DFF0000-0x000002569E268000-memory.dmp	family_zgrat_v1
behavioral1/memory/2448-4925-0x0000000009000000-0x00000000092B6000-memory.dmp	family_zgrat_v1

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5088-4902-0x0000000140000000-0x00000001400E9000-memory.dmp	family_meduza
behavioral1/memory/5088-9810-0x0000000140000000-0x00000001400E9000-memory.dmp	family_meduza

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 2 IoCs

Processes:

chalengesophisticated.exechallengesophisticated.exe

pid process

2160 chalengesophisticated.exe
2448 challengesophisticated.exe

pid	process
2160	chalengesophisticated.exe
2448	challengesophisticated.exe

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 api.ipify.org
52 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

chalengesophisticated.exe

description pid process target process

PID 2160 set thread context of 5088 2160 chalengesophisticated.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeInstallUtil.exe

pid process

4256 powershell.exe
4256 powershell.exe
5088 InstallUtil.exe
5088 InstallUtil.exe

flow	ioc
51	api.ipify.org
52	api.ipify.org

description	pid	process	target process
PID 2160 set thread context of 5088	2160	chalengesophisticated.exe	InstallUtil.exe

pid	process
4256	powershell.exe
4256	powershell.exe
5088	InstallUtil.exe
5088	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

chalengesophisticated.exepowershell.exechallengesophisticated.exe

description	pid	process
Token: SeDebugPrivilege	2160	chalengesophisticated.exe
Token: SeDebugPrivilege	2160	chalengesophisticated.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	2448	challengesophisticated.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exechalengesophisticated.exe

description	pid	process	target process
PID 4988 wrote to memory of 2160	4988	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	chalengesophisticated.exe
PID 4988 wrote to memory of 2160	4988	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	chalengesophisticated.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 5088	2160	chalengesophisticated.exe	InstallUtil.exe
PID 2160 wrote to memory of 4256	2160	chalengesophisticated.exe	powershell.exe
PID 2160 wrote to memory of 4256	2160	chalengesophisticated.exe	powershell.exe
PID 4988 wrote to memory of 2448	4988	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	challengesophisticated.exe
PID 4988 wrote to memory of 2448	4988	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	challengesophisticated.exe
PID 4988 wrote to memory of 2448	4988	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	challengesophisticated.exe

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe
"C:\Users\Admin\AppData\Local\Temp\53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:5088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe' -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
Filesize
14.5MB

MD5
66d0f556615ce40c851f1b7347773570

SHA1
5bf87f9716e522cf4f77a03fd7caa3ed94ad7882

SHA256
725e9172a1aafa7d2e4bdf37257df0d67f6c307035f7ad893a0bc5dad58dd199

SHA512
4a67a0173a3073b4b177a2e5d42dc62c8b3a5c159d82c73fa177f439880df14c6e7b7b2d8dec855b3fc0ceb7cb395d85cec40e5d5e31ebe8fa089e0e8282137f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
Filesize
16.4MB

MD5
aee8e83de9876ffaf39c78af9e288505

SHA1
5099fa9c38a612ed01b452bbfe36cd7c529deccc

SHA256
94e7120a4b7e58905de44f90abdce85f3ce97669249563ca50680dcecdd5bc7c

SHA512
1019222635fcf1b8477d19177e77dedbdbcac4eecf3bb096dc60204448eca653771fc33fb124bfb79e9bcf5d5de68a4fd61cf18d7dc8cbfc2e538aa4713e5ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gddmqfr2.q5b.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2160-7-0x00007FFDB0700000-0x00007FFDB11C1000-memory.dmp

Filesize
10.8MB

Download
memory/2160-8-0x0000025681FF0000-0x0000025682E74000-memory.dmp

Filesize
14.5MB

Download
memory/2160-9-0x000002569D600000-0x000002569D610000-memory.dmp

Filesize
64KB

Download
memory/2160-10-0x000002569DFF0000-0x000002569E26E000-memory.dmp

Filesize
2.5MB

Download
memory/2160-20-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-32-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-36-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-34-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-30-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-28-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-24-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-22-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-26-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-16-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-14-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-11-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-18-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-12-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-46-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-60-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-62-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-68-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-74-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-72-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-64-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-58-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-56-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-54-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-70-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-66-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-52-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-50-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-48-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-44-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-42-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-40-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-38-0x000002569DFF0000-0x000002569E268000-memory.dmp

Filesize
2.5MB

Download
memory/2160-4891-0x00000256832B0000-0x00000256832B1000-memory.dmp

Filesize
4KB

Download
memory/2160-4892-0x0000025684B00000-0x0000025684BBA000-memory.dmp

Filesize
744KB

Download
memory/2160-4893-0x0000025684CE0000-0x0000025684D2C000-memory.dmp

Filesize
304KB

Download
memory/2160-4894-0x00007FFDB0700000-0x00007FFDB11C1000-memory.dmp

Filesize
10.8MB

Download
memory/2160-4895-0x000002569D600000-0x000002569D610000-memory.dmp

Filesize
64KB

Download
memory/2160-4897-0x000002569D510000-0x000002569D564000-memory.dmp

Filesize
336KB

Download
memory/2160-4903-0x00007FFDB0700000-0x00007FFDB11C1000-memory.dmp

Filesize
10.8MB

Download
memory/2448-4919-0x0000000000530000-0x000000000159C000-memory.dmp

Filesize
16.4MB

Download
memory/2448-4921-0x0000000005DB0000-0x0000000005E42000-memory.dmp

Filesize
584KB

Download
memory/2448-4925-0x0000000009000000-0x00000000092B6000-memory.dmp

Filesize
2.7MB

Download
memory/2448-4926-0x0000000009870000-0x0000000009E14000-memory.dmp

Filesize
5.6MB

Download
memory/2448-9809-0x00000000061A0000-0x0000000006294000-memory.dmp

Filesize
976KB

Download
memory/4256-4912-0x00000239CBE80000-0x00000239CBEA2000-memory.dmp

Filesize
136KB

Download
memory/5088-4902-0x0000000140000000-0x00000001400E9000-memory.dmp

Filesize
932KB

Download
memory/5088-9810-0x0000000140000000-0x00000001400E9000-memory.dmp

Filesize
932KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads