Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 18:39
General
-
Target
SecuriteInfo.com.Win64.CrypterX-gen.2448.5331.exe
-
Size
1.8MB
-
MD5
8e2766a1d5ffabdae6603d9dffc5d4bf
-
SHA1
45f1bedf90db66c5af35e80f93d8d0a6181485a5
-
SHA256
127a36b98ea43a374146a0dd7bef8a0323db12a6a74eff3290d3974a1f077714
-
SHA512
adc31e9fe214424f80604383be44b8d9ec9dfd8a5c968dd5b037f0df757e99bb071ceb0019bf98c6b169f7fe328db7fe84a7f1586504fc0e4281830279eb1ecd
-
SSDEEP
24576:u8tBJcvtGlZdN1/Pzl2TFh0lhSMXl1M9uBcbKVqjXRNdZWa3EAZWDpiE:LtBJcsH/m9uBJOBTQa5Z6
Score
10/10
Malware Config
Extracted
Family
meduza
C2
176.124.204.206
Attributes
-
anti_dbg
true
-
anti_vm
true
-
build_name
mounew
-
extensions
.txt
-
grabber_max_size
1.048576e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 1 IoCs
-
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.CrypterX-gen.2448.5331.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.CrypterX-gen.2448.5331.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
4KB