meduza | d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271

General

Target
d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
Size 1.4MB
Sample241001-psrdvazckp
SHA256 d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271
MD5 b27ae81de75690ef4261acdc6e5769a0
SHA1 b029ba2e533630cb9e5b902b593a56b659822c7e
SHA512 1cb1fc4663586c6a8e7fb6ddc4af170d358774bb36b9d56c759faea1858f9ac0402202dbedea6e35e506190ffcedbad304306a9cfb6cff92cdb13bea315a9b78
SSDEEP 24576:86F4Df9Gpethg/DP0jdETe5M8Fo3hXxMtZFx2QzIcI5jAZBrpe3y6:86FKf9Gwhg/DMEYoR8Zj83JAZNpei6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

127.0.0.1

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/5080-3-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral2/memory/5080-6-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral2/memory/5080-5-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral2/memory/5080-9-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Loads dropped DLL 1 IoCs

pid	Process
4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82

C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
"C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
  "C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe"
  2⤵
  - Checks computer location settings
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.exe:extractor.dll

Path C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll
Size 1.1MB
SHA256 424008e47dc13bb56198d3e49f6a7a54004050139c40d78284f52bbb0ad0d56b
MD5 3104dd6b7fa125e4a7ce16174376c971
SHA1 1bff119a6b33f935a835fb06267fcd431f15111f
SHA512 3e0757887530eee18dcc217b5383f6ab18602be9194a6ab7d64819af4d70d83f6a1559222b042d9a4061ad0412e93529a20bcc8ff626e261a85017cb0ba0e21e
SSDEEP 24576:VcUeDK03LyZ2xn7y6ACStMecLxbVoOqFc/ZIymayw5V75TFkHzZu:VcUoK03LTZJSAo7Fk5Jz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4412-8-0x00007FFCB33B0000-0x00007FFCB34DC000-memory.dmp

Download

memory/4412-7-0x00007FF659E00000-0x00007FF659F75000-memory.dmp

Download

memory/5080-3-0x0000000140000000-0x0000000140103000-memory.dmp

Download

memory/5080-6-0x0000000140000000-0x0000000140103000-memory.dmp

Download

memory/5080-5-0x0000000140000000-0x0000000140103000-memory.dmp

Download

memory/5080-9-0x0000000140000000-0x0000000140103000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads