Analysis
-
max time kernel
89s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 20:00
General
-
Target
Roblox_Injector.exe
-
Size
82.3MB
-
MD5
0994ad249360e6fbaa2481fbd27dd46a
-
SHA1
fe89644ae6d153345921ea89105563af9af2c378
-
SHA256
34fbe8cbffafe77563844bc553d2f908dcadb3f850b2655c1e4cbdeb290b5883
-
SHA512
bd514c4694f9bbfe51e3d902ae7c82788f26a3ef934b031439c2c747ccf182b898af8463b1ebf44d44a05691de8eba7eb9005899e56ed8b68930fe27cd294cfc
-
SSDEEP
6144:HCW+QKVcORrNvIorfohjt3XVcORrNvIorfohjt3Z:4QKVcurNAHDVcurNAHt
Malware Config
Extracted
meduza
45.130.145.152
-
anti_dbg
true
-
anti_vm
true
-
build_name
Work
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 6 IoCs
-
Meduza family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox_Injector.exe"C:\Users\Admin\AppData\Local\Temp\Roblox_Injector.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB5AFgAQwBiAHgASQBPAFgAaABsAFwASABlAHEAYgBnAEcAZABTAGQAbwAuAGUAeABlACcA2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\yXCbxIOXhl\HeqbgGdSdo.exe"C:\Users\Admin\AppData\Local\Temp\yXCbxIOXhl\HeqbgGdSdo.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yXCbxIOXhl\HeqbgGdSdo.exeC:\Users\Admin\AppData\Local\Temp\yXCbxIOXhl\HeqbgGdSdo.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4.1MB
MD5dd0b9382bc7d77840b168800bc8cb812
SHA1d5b635efbf79662929b311572e41d7ea612749cc
SHA25693626f2a12a4ab1fbe7e284af0a3368c4041e58428f18429acc64d3f09067a29
SHA512d59b6f1496eade71a929c054523fa4815b5786226e0f1a62a6c0855ce5f2d2759ade49f1c00f657474c87a0d0a8a01fbc49644a766dde3556ccc9994152679de
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
68KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
652KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
82.3MB
-
Filesize
7.7MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB