meduza | 0aeaf8afee14d5be2425ed7826c7895b1c318397ab7f3bb1523a9b62061c1ef8

Resubmissions

11-10-2024 07:00

241011-hsnvds1aqa 10

07-08-2024 08:37

240807-kja82syfka 10

07-08-2024 08:30

240807-kd6g1ayemg 10

Analysis

max time kernel
95s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe
Size

2.1MB
MD5

0468a32ad1ed1169e98b897d87f51164
SHA1

0d9dc54a5f91e6ed7d324c2a65b152a168d57b08
SHA256

643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2
SHA512

7deb90629608f3a227e96d948bbb4c78ad21e1eb659bfdab903d4f25bdb1e6c8af7edec9604274aa745dd90f8253e48fbccf661f2bc2b6609e5b8807645750ca
SSDEEP

24576:GQZEhAybJ37KtuUZ786qGbAJYhIRKPS0dJDhrI4ufnLVVx90e+7ym:WAC3a78sIRSGVV8V5

Score

10^/10

meduza stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3476-0-0x000002074BEC0000-0x000002074BFA9000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe

C:\Users\Admin\AppData\Local\Temp\643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe
"C:\Users\Admin\AppData\Local\Temp\643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe"
1⤵
- Checks computer location settings
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3476-0-0x000002074BEC0000-0x000002074BFA9000-memory.dmp

Filesize
932KB

Download