Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.9MB
-
MD5
a9fe6ad4be60831ae6d7bcf8fbab71cd
-
SHA1
6e0f5b29b61626fd7128748090bb56ea8f9c3ce9
-
SHA256
87697941ff8ba3536ed56db6d7c2eb48f0cc791e50d4e3aeae2ad6e7eca3dd53
-
SHA512
f31c412d5fdee6927acf6181029ce9f09584c62d2566c2f8f64701260df5dfaaee549d378131936cb03773378c4d740b8ebc427be90d5b84ac3787c59bb96284
-
SSDEEP
49152:lmqMVsNnj15T+lai8AbUcwOBuxrjrtzfH7FB5j0AEwt:Ihgj15ila7fH7f5j9
Malware Config
Signatures
-
Meduza Stealer payload 1 IoCs
resource yara_rule sample family_meduza -
Meduza family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:6 windows x86 arch:x86
2199dc9755ee1481b3b8567314ef55b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpQueryInfoW
InternetOpenUrlA
InternetQueryDataAvailable
InternetOpenA
InternetReadFile
rstrtmgr
RmGetList
RmRegisterResources
RmStartSession
RmEndSession
ntdll
RtlUnwind
NtQueryObject
NtQuerySystemInformation
crypt32
CryptUnprotectData
ws2_32
socket
WSACleanup
htons
inet_addr
connect
send
closesocket
WSAStartup
kernel32
InitializeCriticalSectionEx
GetComputerNameA
GetLastError
GlobalMemoryStatusEx
GetModuleHandleW
GetProcAddress
GetNativeSystemInfo
GetProductInfo
GetModuleFileNameA
GetUserGeoID
GetGeoInfoA
DecodePointer
DeleteCriticalSection
GetProcessHeap
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetProcessId
GetModuleHandleA
OpenProcess
GetFinalPathNameByHandleA
CloseHandle
GetFileSize
SetFilePointer
ReadFile
GetSystemInfo
WideCharToMultiByte
LocalFree
ExitProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetLastError
EncodePointer
VirtualQuery
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
VirtualAlloc
VirtualProtect
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetFileType
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
SetEndOfFile
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
OutputDebugStringW
SetStdHandle
GetStringTypeW
CreateFileW
WriteConsoleW
GetFileInformationByHandleEx
AreFileApisANSI
LCMapStringEx
CompareStringEx
RaiseException
FlushFileBuffers
GetFileAttributesExW
FindFirstFileW
GetLocaleInfoEx
FormatMessageA
user32
GetDC
ReleaseDC
EnumDisplayDevicesW
UnregisterClassW
GetSystemMetrics
gdi32
BitBlt
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
SelectObject
DeleteDC
GetObjectW
advapi32
RegQueryValueExA
RegOpenKeyExA
GetCurrentHwProfileW
RegCloseKey
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
CreateStreamOnHGlobal
shlwapi
ord214
ord213
ord184
gdiplus
GdipFree
GdipAlloc
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncoders
GdipCreateBitmapFromScan0
GdipSaveImageToStream
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 405KB - Virtual size: 455KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 247KB - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ