meduza | 75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb

General

Target

75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
Size

1.1MB
MD5

e3a08541070dcb1f4fe7d82af869c3bc
SHA1

6b4ad3774d42d4eead3f0a63a8afcfdf559bb557
SHA256

75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb
SHA512

7d0a9b0b7460a6c9e2570a3c7cd352a7a81a4174bafdc78ce089647b5579590fd98221d175c682b114482c26685b0d7aa5d5cc9f2cf9405110195d5ca2089949
SSDEEP

24576:XNPRWzRyOt2F2qXR25d8L0yFlmxYG7Kf/2C9:XNwn2FNR2XkyGX2C

Score

10^/10

meduza discovery stealer

Malware Config

Extracted

Family

meduza

C2

78.153.131.36

Attributes

build_tag
222
extensions
grabber
false
mode
x86
port
22322
screenshot
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2152-2-0x00000000023A0000-0x000000000258F000-memory.dmp	family_meduza
behavioral2/memory/2152-3-0x0000000000400000-0x00000000005FC000-memory.dmp	family_meduza
behavioral2/memory/2152-6-0x00000000023A0000-0x000000000258F000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\International\Geo\Nation	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2148	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
4792	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
3848	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
4788	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
4264	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
168	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
2588	2152	WerFault.exe	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe

C:\Users\Admin\AppData\Local\Temp\75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe
"C:\Users\Admin\AppData\Local\Temp\75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 796
  2⤵
  - Program crash
  PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 884
  2⤵
  - Program crash
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1036
  2⤵
  - Program crash
  PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1116
  2⤵
  - Program crash
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1084
  2⤵
  - Program crash
  PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1128
  2⤵
  - Program crash
  PID:168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1180
  2⤵
  - Program crash
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-1-0x0000000000710000-0x00000000007F9000-memory.dmp

Filesize
932KB

Download
memory/2152-2-0x00000000023A0000-0x000000000258F000-memory.dmp

Filesize
1.9MB

Download
memory/2152-3-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2152-5-0x0000000000710000-0x00000000007F9000-memory.dmp

Filesize
932KB

Download
memory/2152-6-0x00000000023A0000-0x000000000258F000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads