Behavioral task
behavioral1
Sample
7ba61f3706d900ad4fdf101227727b88ed4da64147d1bdea8b2e9d88e3e73b15.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ba61f3706d900ad4fdf101227727b88ed4da64147d1bdea8b2e9d88e3e73b15.exe
Resource
win10v2004-20241007-en
General
-
Target
7ba61f3706d900ad4fdf101227727b88ed4da64147d1bdea8b2e9d88e3e73b15.exe
-
Size
1.2MB
-
MD5
1a2e3cefb9b08af38db92cab7264f6b3
-
SHA1
e31ab02e4a2cfb5dfbc8bc33c6e392bcb03c2bc3
-
SHA256
7ba61f3706d900ad4fdf101227727b88ed4da64147d1bdea8b2e9d88e3e73b15
-
SHA512
4ff510a5530227b35d5cdc5efc3fdb8c6531c1a785519379175fd9fc167f20a9f9444f419cedde3a2215cf0836025357e363315b8422d7d198a7f96727671a16
-
SSDEEP
24576:l5Uah/dTnglhmsqrKPYS1gm7K87h0lhSMXl1vN:nUaldTUcsqaYwh/Kl1
Malware Config
Extracted
meduza
147.45.44.212
-
anti_dbg
true
-
anti_vm
true
-
build_name
mounow
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_meduza -
Meduza family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7ba61f3706d900ad4fdf101227727b88ed4da64147d1bdea8b2e9d88e3e73b15.exe
Files
-
7ba61f3706d900ad4fdf101227727b88ed4da64147d1bdea8b2e9d88e3e73b15.exe.exe windows:6 windows x64 arch:x64
674c15ed1eaebfd2be4ff06070cd7c50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
inet_pton
WSAStartup
htons
send
socket
connect
recv
closesocket
crypt32
CryptUnprotectData
CryptProtectData
wininet
HttpQueryInfoW
InternetQueryDataAvailable
InternetReadFile
InternetOpenW
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
ntdll
NtQueryObject
RtlReleasePebLock
NtQuerySystemInformation
RtlInitUnicodeString
NtAllocateVirtualMemory
LdrEnumerateLoadedModules
RtlAcquirePebLock
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
kernel32
GetFileInformationByHandleEx
FindFirstFileW
FindNextFileW
FindClose
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
LoadLibraryA
Process32FirstW
CloseHandle
GetSystemInfo
GetProcAddress
LocalFree
FreeLibrary
GetLastError
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
ReadFile
WriteFile
CreateFileW
GetFileSize
GetCurrentProcess
VirtualQuery
GetStdHandle
TerminateProcess
CreateMutexA
ReleaseMutex
OpenMutexA
GetModuleFileNameA
GetVolumeInformationW
GetGeoInfoA
HeapFree
EnterCriticalSection
GetModuleFileNameW
GetProcessId
LeaveCriticalSection
SetFilePointer
InitializeCriticalSectionEx
FreeEnvironmentStringsW
GetModuleHandleA
HeapSize
GetLogicalDriveStringsW
GetFinalPathNameByHandleA
GetTimeZoneInformation
lstrcatW
HeapReAlloc
HeapAlloc
GetUserGeoID
DecodePointer
GetComputerNameW
GlobalMemoryStatusEx
lstrcpyW
GetEnvironmentStringsW
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetFileSizeEx
SetFilePointerEx
GetCurrentThreadId
GetFileType
GetStartupInfoW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
SetEndOfFile
GetModuleHandleExW
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
WriteConsoleW
OutputDebugStringW
SetEnvironmentVariableW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
RtlUnwind
RtlPcToFileHeader
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
AreFileApisANSI
GetNativeSystemInfo
LCMapStringEx
CompareStringEx
GetProcessHeap
GetModuleHandleW
GetCommandLineA
GetCommandLineW
DeleteCriticalSection
RaiseException
GetFileAttributesExW
GetFileAttributesW
FindFirstFileExW
GetCurrentDirectoryW
GetLocaleInfoEx
FormatMessageA
user32
EnumDisplayDevicesW
GetDesktopWindow
ReleaseDC
GetSystemMetrics
GetDC
GetWindowRect
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
GetCurrentHwProfileW
RegCloseKey
RegGetValueA
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
RegEnumKeyExA
RevertToSelf
ConvertSidToStringSidA
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
CredEnumerateA
CredFree
shell32
SHGetKnownFolderPath
ShellExecuteW
ole32
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoGetObject
oleaut32
SysAllocStringByteLen
SysStringByteLen
SysFreeString
shlwapi
ord12
ord214
ord213
ord184
gdiplus
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipSaveImageToStream
Sections
.text Size: 836KB - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 361KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ