meduza | ddff18268a87a6d5200836c3219ba973a0e1a60135d5e543cf06d315348ab71b

General

Target

file.exe
Size

1.4MB
MD5

eab6ffe7b3ed8b11859e3c2858cb1b48
SHA1

c825fcb349ed78c6fe437605ef17a9c1ab76fc32
SHA256

ddff18268a87a6d5200836c3219ba973a0e1a60135d5e543cf06d315348ab71b
SHA512

06f8da78780bd504ad912b1aecfc76b9a4e04ff2b513202fd7ff56ada7a2b60fc74d6c294da74c7c2f3eb75653c730e98fef8f7e1dcc0ab7ea1c9b17cae6375f
SSDEEP

24576:OiGYw/6K/bd1YYJaOZpwxWs+RmATcoPoVLmudtnhNxeytXP7JLxtC:OiGJ/BRVTvPo5nhTeytXP7JltC

Score

10^/10

meduza collection discovery stealer

Malware Config

Extracted

Family

meduza

C2

176.124.204.206

Attributes

anti_dbg
true
anti_vm
true
build_name
mob2
extensions
.txt
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 11 IoCs

resource	yara_rule
behavioral1/memory/2764-9-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-4-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-5-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-6-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-13-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2196-10-0x000000013FBA0000-0x000000013FD0C000-memory.dmp	family_meduza
behavioral1/memory/2764-7-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-3-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-12-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-29-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza
behavioral1/memory/2764-30-0x0000000140000000-0x0000000140147000-memory.dmp	family_meduza

Meduza family
meduza

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 2764	2196	file.exe	31

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	attrib.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	attrib.exe
Token: SeImpersonatePrivilege	2764	attrib.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31
PID 2196 wrote to memory of 2764	2196	file.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2764	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	attrib.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Views/modifies file attributes
  - outlook_office_path
  - outlook_win_path
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Browser Information Discovery

1

T1217

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-10-0x000000013FBA0000-0x000000013FD0C000-memory.dmp

Filesize
1.4MB

Download
memory/2764-6-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-8-0x000007FFFFFDC000-0x000007FFFFFDD000-memory.dmp

Filesize
4KB

Download
memory/2764-2-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-4-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-5-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-0-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-13-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-9-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-7-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-3-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-1-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-12-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-29-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2764-30-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing