meduza | 0aeaf8afee14d5be2425ed7826c7895b1c318397ab7f3bb1523a9b62061c1ef8

Resubmissions

11/10/2024, 07:00

241011-hsnvds1aqa10

07/08/2024, 08:37

240807-kja82syfka10

07/08/2024, 08:30

240807-kd6g1ayemg10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe
Size 2.1MB
Sample241011-hsnvds1aqa
SHA256 643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2
MD5 0468a32ad1ed1169e98b897d87f51164
SHA1 0d9dc54a5f91e6ed7d324c2a65b152a168d57b08
SHA512 7deb90629608f3a227e96d948bbb4c78ad21e1eb659bfdab903d4f25bdb1e6c8af7edec9604274aa745dd90f8253e48fbccf661f2bc2b6609e5b8807645750ca
SSDEEP 24576:GQZEhAybJ37KtuUZ786qGbAJYhIRKPS0dJDhrI4ufnLVVx90e+7ym:WAC3a78sIRSGVV8V5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

5.42.107.78

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2608-0-0x0000012331E60000-0x0000012331F49000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe

C:\Users\Admin\AppData\Local\Temp\643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe
"C:\Users\Admin\AppData\Local\Temp\643dde3f461907a94f145b3cd8fe37dbad63aec85a4e5ed759fe843b9214a8d2.exe"
1⤵
- Checks computer location settings
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-0-0x0000012331E60000-0x0000012331F49000-memory.dmp

Download