Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
24/08/2024, 18:52
General
- Target c7f5b7d74949d93c28e67b38ec2a2e43e91d81f713f81426be3f2c708b3c2f39.exe
- Size 4.9MB
- Sample240824-xh8t5stepb
- SHA256 c7f5b7d74949d93c28e67b38ec2a2e43e91d81f713f81426be3f2c708b3c2f39
Malware Config
Signatures
- Meduza
Meduza is a crypto wallet and info stealer written in C++.
- Meduza Stealer payload 2 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f5b7d74949d93c28e67b38ec2a2e43e91d81f713f81426be3f2c708b3c2f39.exe"C:\Users\Admin\AppData\Local\Temp\c7f5b7d74949d93c28e67b38ec2a2e43e91d81f713f81426be3f2c708b3c2f39.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2104-16-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-70-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2104-57-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2104-56-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2104-55-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2104-34-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-40-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-42-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-44-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-20-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-22-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-26-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-24-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/2104-18-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2104-17-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2104-15-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/3204-11-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/3204-8-0x0000000009280000-0x0000000009542000-memory.dmp
memory/3204-13-0x0000000006E80000-0x0000000006E9A000-memory.dmp
memory/3204-12-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/3204-0-0x000000007464E000-0x000000007464F000-memory.dmp
memory/3204-10-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/3204-9-0x0000000005230000-0x0000000005236000-memory.dmp
memory/3204-61-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/3204-7-0x000000007464E000-0x000000007464F000-memory.dmp
memory/3204-6-0x00000000057D0000-0x00000000057DA000-memory.dmp
memory/3204-5-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/3204-4-0x0000000005890000-0x000000000592C000-memory.dmp
memory/3204-3-0x00000000057F0000-0x0000000005882000-memory.dmp
memory/3204-2-0x0000000005CC0000-0x0000000006264000-memory.dmp
memory/3204-14-0x0000000006E10000-0x0000000006E16000-memory.dmp
memory/3204-1-0x0000000000630000-0x0000000000B20000-memory.dmp
memory/3880-74-0x00000000083F0000-0x000000000842C000-memory.dmp
memory/3880-68-0x0000000000400000-0x000000000045A000-memory.dmp
memory/3880-71-0x00000000088E0000-0x0000000008EF8000-memory.dmp
memory/3880-72-0x0000000008440000-0x000000000854A000-memory.dmp
memory/3880-73-0x0000000008390000-0x00000000083A2000-memory.dmp
memory/3880-75-0x0000000008550000-0x000000000859C000-memory.dmp
memory/3880-76-0x00000000087C0000-0x0000000008826000-memory.dmp
memory/3880-77-0x0000000009100000-0x0000000009176000-memory.dmp
memory/3880-78-0x0000000008860000-0x000000000887E000-memory.dmp
memory/3880-79-0x000000000A440000-0x000000000A602000-memory.dmp
memory/3880-80-0x000000000AB40000-0x000000000B06C000-memory.dmp
memory/4708-59-0x0000000000400000-0x00000000005FC000-memory.dmp
memory/4708-58-0x0000000000400000-0x00000000005FC000-memory.dmp