Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2024, 21:56

General

  • Target

    7e54a7116084a46c67f9e8d322a3d8cb.exe

  • Size

    2.5MB

  • MD5

    7e54a7116084a46c67f9e8d322a3d8cb

  • SHA1

    7de5bee58489956c8d3289b34cbcbc170692b19d

  • SHA256

    0a1608b4aa718e709e8238a423ce9000b19082bad96eff1778172cd5765c86f9

  • SHA512

    9b1c6ea2bbfd73969e13f94ae78527e7fe6867cfede1077e5795bb94adc218c4a53f1c0adabe84535e820f66f1a0f0bfeb8fba21515031911473242c023b71db

  • SSDEEP

    24576:MoEKQByjnqh0lhSMXlLNST22imnvQP+JA0vrRcoiXIRclY2pzDBPMet++ngic:jLzjnZDmvs+u0vVc1IRWfEet+ig

Malware Config

Extracted

Family

meduza

C2

150.241.92.160

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    mrfree

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    4.194304e+06

  • port

    15666

  • self_destruct

    false

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 47 IoCs
  • Meduza family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e54a7116084a46c67f9e8d322a3d8cb.exe
    "C:\Users\Admin\AppData\Local\Temp\7e54a7116084a46c67f9e8d322a3d8cb.exe"
    1⤵
    • Checks computer location settings
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:2184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2184-0-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-3-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-11-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-18-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-16-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-13-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-12-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-9-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-6-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-4-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-1-0x0000025ABA160000-0x0000025ABA161000-memory.dmp

    Filesize

    4KB

  • memory/2184-10-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-5-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-25-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-26-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-30-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-29-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-32-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-31-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-37-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-38-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-36-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-33-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-43-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-52-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-76-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-81-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-82-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-80-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-73-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-68-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-67-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-62-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-56-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-55-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-50-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-49-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-46-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-44-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-74-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-61-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-40-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-39-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-84-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-87-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-90-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-89-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-83-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB

  • memory/2184-93-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp

    Filesize

    2.0MB