meduza | ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef

General

Target

ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe
Size

1.4MB
MD5

82eecea4083e39c33733428c2d845b15
SHA1

02cfb61e8cb6242890cf58e25c26136d4ce46709
SHA256

ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef
SHA512

4528e6033ea1cf4a0de232d3ec74bffead24d17dd2d4a2ceac4f73f2e2b94babd53e14bc9eca5661c41f4692b730d9096f5255936c19de7b2671bf8f226899df
SSDEEP

24576:Yr3uXCxRUKRErpNT3ixen3EyJvRvEx+aFwGSMn/FQiG654Sr:Yreyx7ErOe3XvRvRayM/FU+4s

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

95.181.173.8

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2832-19-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-23-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-24-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-17-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-15-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-13-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-11-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza
behavioral1/memory/2832-9-0x0000000140000000-0x000000014011D000-memory.dmp	family_meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

Loads dropped DLL 1 IoCs

pid	Process
1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\a.exe:extractor.dll	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30
PID 1504 wrote to memory of 2832	1504	ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe	30

C:\Users\Admin\AppData\Local\Temp\ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe
"C:\Users\Admin\AppData\Local\Temp\ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe
  "C:\Users\Admin\AppData\Local\Temp\ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe"
  2⤵
  - Checks computer location settings
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-22-0x000007FEF7CD0000-0x000007FEF7E08000-memory.dmp

Filesize
1.2MB

Download
memory/2832-15-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-23-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-24-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-17-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-19-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-13-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-11-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-9-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-4-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-8-0x000007FFFFFDB000-0x000007FFFFFDC000-memory.dmp

Filesize
4KB

Download
memory/2832-7-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2832-6-0x000007FFFFFDB000-0x000007FFFFFDC000-memory.dmp

Filesize
4KB

Download
memory/2832-5-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing