meduza | 114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

General

Target

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Size

1.2MB
MD5

ef95411945330db1907508d38bc373ac
SHA1

7bb8d57cb26f3927bd741db598254efd72f249c4
SHA256

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323
SHA512

2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c
SSDEEP

24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8

Score

10^/10

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4352-0-0x00000172A0D50000-0x00000172A0E39000-memory.dmp	family_meduza

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

Email Collection

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 api.ipify.org
19 api.ipify.org
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
18	api.ipify.org
19	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

pid	process
4352	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
4352	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

outlook_office_path 1 IoCs

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

outlook_win_path 1 IoCs

Processes:

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe