Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/11/2024, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
7e54a7116084a46c67f9e8d322a3d8cb.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7e54a7116084a46c67f9e8d322a3d8cb.exe
Resource
win10v2004-20241007-en
General
-
Target
7e54a7116084a46c67f9e8d322a3d8cb.exe
-
Size
2.5MB
-
MD5
7e54a7116084a46c67f9e8d322a3d8cb
-
SHA1
7de5bee58489956c8d3289b34cbcbc170692b19d
-
SHA256
0a1608b4aa718e709e8238a423ce9000b19082bad96eff1778172cd5765c86f9
-
SHA512
9b1c6ea2bbfd73969e13f94ae78527e7fe6867cfede1077e5795bb94adc218c4a53f1c0adabe84535e820f66f1a0f0bfeb8fba21515031911473242c023b71db
-
SSDEEP
24576:MoEKQByjnqh0lhSMXlLNST22imnvQP+JA0vrRcoiXIRclY2pzDBPMet++ngic:jLzjnZDmvs+u0vVc1IRWfEet+ig
Malware Config
Extracted
meduza
150.241.92.160
-
anti_dbg
true
-
anti_vm
true
-
build_name
mrfree
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza Stealer payload 47 IoCs
resource yara_rule behavioral2/memory/2184-3-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-11-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-18-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-16-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-13-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-12-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-9-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-6-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-4-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-10-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-5-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-25-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-26-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-30-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-29-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-32-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-31-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-37-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-38-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-36-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-33-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-43-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-52-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-76-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-81-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-82-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-80-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-73-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-68-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-67-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-62-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-56-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-55-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-50-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-49-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-46-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-44-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-74-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-61-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-40-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-39-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-84-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-87-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-90-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-89-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-83-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza behavioral2/memory/2184-93-0x0000025ABBBC0000-0x0000025ABBDBA000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 7e54a7116084a46c67f9e8d322a3d8cb.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2184 7e54a7116084a46c67f9e8d322a3d8cb.exe 2184 7e54a7116084a46c67f9e8d322a3d8cb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2184 7e54a7116084a46c67f9e8d322a3d8cb.exe Token: SeImpersonatePrivilege 2184 7e54a7116084a46c67f9e8d322a3d8cb.exe -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e54a7116084a46c67f9e8d322a3d8cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e54a7116084a46c67f9e8d322a3d8cb.exe"C:\Users\Admin\AppData\Local\Temp\7e54a7116084a46c67f9e8d322a3d8cb.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2184