meduza | d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271

General

Target

d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
Size

1.4MB
MD5

b27ae81de75690ef4261acdc6e5769a0
SHA1

b029ba2e533630cb9e5b902b593a56b659822c7e
SHA256

d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271
SHA512

1cb1fc4663586c6a8e7fb6ddc4af170d358774bb36b9d56c759faea1858f9ac0402202dbedea6e35e506190ffcedbad304306a9cfb6cff92cdb13bea315a9b78
SSDEEP

24576:86F4Df9Gpethg/DP0jdETe5M8Fo3hXxMtZFx2QzIcI5jAZBrpe3y6:86FKf9Gwhg/DMEYoR8Zj83JAZNpei6

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

127.0.0.1

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/5080-3-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral2/memory/5080-6-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral2/memory/5080-5-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza
behavioral2/memory/5080-9-0x0000000140000000-0x0000000140103000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Loads dropped DLL 1 IoCs

pid	Process
4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82
PID 4412 wrote to memory of 5080	4412	d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe	82

C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
"C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe
  "C:\Users\Admin\AppData\Local\Temp\d2edacc2d2c86bda72a21a93c44a075b29c2f88978235a951c0b15262183c271N.exe"
  2⤵
  - Checks computer location settings
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll

Filesize
1.1MB

MD5
3104dd6b7fa125e4a7ce16174376c971

SHA1
1bff119a6b33f935a835fb06267fcd431f15111f

SHA256
424008e47dc13bb56198d3e49f6a7a54004050139c40d78284f52bbb0ad0d56b

SHA512
3e0757887530eee18dcc217b5383f6ab18602be9194a6ab7d64819af4d70d83f6a1559222b042d9a4061ad0412e93529a20bcc8ff626e261a85017cb0ba0e21e

Download Submit
memory/4412-8-0x00007FFCB33B0000-0x00007FFCB34DC000-memory.dmp

Filesize
1.2MB

Download
memory/4412-7-0x00007FF659E00000-0x00007FF659F75000-memory.dmp

Filesize
1.5MB

Download
memory/5080-3-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/5080-6-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/5080-5-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/5080-9-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing