meduza | d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271

General

Target

d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
Size

1.4MB
MD5

b27ae81de75690ef4261acdc6e5769a0
SHA1

b029ba2e533630cb9e5b902b593a56b659822c7e
SHA256

d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271
SHA512

1cb1fc4663586c6a8e7fb6ddc4af170d358774bb36b9d56c759faea1858f9ac0402202dbedea6e35e506190ffcedbad304306a9cfb6cff92cdb13bea315a9b78
SSDEEP

24576:86F4Df9Gpethg/DP0jdETe5M8Fo3hXxMtZFx2QzIcI5jAZBrpe3y6:86FKf9Gwhg/DMEYoR8Zj83JAZNpei6

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

127.0.0.1

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/1684-23-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-24-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-18-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-16-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-14-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-12-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-10-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral1/memory/1684-8-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Loads dropped DLL 1 IoCs

pid	Process
1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30
PID 1756 wrote to memory of 1684	1756	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	30

C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
"C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
  "C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe"
  2⤵
  - Checks computer location settings
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-6-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-10-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-24-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-5-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

Filesize
4KB

Download
memory/1684-18-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-16-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-23-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-12-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-14-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-8-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-7-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

Filesize
4KB

Download
memory/1684-4-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1684-3-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1756-22-0x000007FEF7C90000-0x000007FEF7DBC000-memory.dmp

Filesize
1.2MB

Download
memory/1756-20-0x000000013F0B0000-0x000000013F225000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing