Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cc9c73aac9...5N.exe

windows7-x64

10

cc9c73aac9...5N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    15s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2024, 22:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc9c73aac9f1c82c39f84f29d4509cfd439f45fa4685ca4e15b6e4af7db13925N.exe

  • Size

    2.5MB

  • MD5

    628e890bda2ac6042c811f60f819e130

  • SHA1

    39fb4ef585197107f3418228e490529b98249054

  • SHA256

    cc9c73aac9f1c82c39f84f29d4509cfd439f45fa4685ca4e15b6e4af7db13925

  • SHA512

    32a04101f317f39e9c9fd4da22aa793c2f990898644c751457499f58ad51a439afdb7ce99d850950216a9d83fdbf996e65bcf3277b7c91230e8f75f7266a2b94

  • SSDEEP

    24576:yCzGVH7Och0lhSMXl7+wzJ+EZ+e/qLH4aDtSGSVBK0pQos:yMGVbo6bu/qLpgGSTpp

Score
10/10
meduzastealer

Malware Config

Extracted

Family

meduza

C2

109.172.94.66

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    SEO

  • extensions

    .txt

  • grabber_max_size

    1.048576e+06

  • port

    15666

  • self_destruct

    false

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza
  • Meduza Stealer payload 2 IoCs
  • Meduza family
    meduza
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc9c73aac9f1c82c39f84f29d4509cfd439f45fa4685ca4e15b6e4af7db13925N.exe
    "C:\Users\Admin\AppData\Local\Temp\cc9c73aac9f1c82c39f84f29d4509cfd439f45fa4685ca4e15b6e4af7db13925N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1600-0-0x0000000002050000-0x0000000002197000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1600-1-0x0000000002050000-0x0000000002197000-memory.dmp

    Filesize

    1.3MB

    Download