meduza | aa46a10b5392afadabb645417e88a32a95a82796b4b9517ea983ee589ed78ab6

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa46a10b5392afadabb645417e88a32a95a82796b4b9517ea983ee589ed78ab6.exe
Size

1.5MB
MD5

15d9dc56b9a997471275fb1281048971
SHA1

8cc0fcec88880863806a689529a23e530167bed6
SHA256

aa46a10b5392afadabb645417e88a32a95a82796b4b9517ea983ee589ed78ab6
SHA512

e9b80928c969568fbfc03392e1859b36f1eb64e79975b8881170c9eb4c59d2b080ad715b7938bdfd617d9c833413064dd329d5e128aafdd2ffd18b162f17f781
SSDEEP

24576:n37gywC0vAr0GWnb/qKoBLgSeUs0UcRVjb+1K0XtA:376vtnlYs0Za1Kt

Score

10^/10

meduza stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3856-0-0x000001A218350000-0x000001A218439000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	aa46a10b5392afadabb645417e88a32a95a82796b4b9517ea983ee589ed78ab6.exe

C:\Users\Admin\AppData\Local\Temp\aa46a10b5392afadabb645417e88a32a95a82796b4b9517ea983ee589ed78ab6.exe
"C:\Users\Admin\AppData\Local\Temp\aa46a10b5392afadabb645417e88a32a95a82796b4b9517ea983ee589ed78ab6.exe"
1⤵
- Checks computer location settings
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x000001A218350000-0x000001A218439000-memory.dmp

Filesize
932KB

Download