Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-11-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe
Resource
win7-20240903-en
General
-
Target
306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe
-
Size
70.1MB
-
MD5
d9ecf06c01f13e20c692308977343e6c
-
SHA1
895103bff07402081cf606e943a9b305bab14798
-
SHA256
306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712
-
SHA512
06bb95938904137a1a4a313c2d557eae9fb38eea43918b6f508debb0aa6fc7d0f211d34af019b59d1e538a8d0f7d0ecb1382653f628148b21f3df5c310d9f68b
-
SSDEEP
3072:yhuwQp8xdrQrJPn4vxyrQUwsy5TDoDLyTKJvwCHtpxC5Ev3+9af5dWcZ2iYi6Jz:yhdQp8xurN4JlU94SyTKJPpTHf3zZ4
Malware Config
Extracted
meduza
45.130.145.152
-
anti_dbg
true
-
anti_vm
true
-
build_name
Work
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza Stealer payload 6 IoCs
resource yara_rule behavioral1/memory/2964-32-0x0000000140000000-0x000000014013E000-memory.dmp family_meduza behavioral1/memory/2964-36-0x0000000140000000-0x000000014013E000-memory.dmp family_meduza behavioral1/memory/2964-41-0x0000000140000000-0x000000014013E000-memory.dmp family_meduza behavioral1/memory/2964-34-0x0000000140000000-0x000000014013E000-memory.dmp family_meduza behavioral1/memory/2964-30-0x0000000140000000-0x000000014013E000-memory.dmp family_meduza behavioral1/memory/2964-39-0x0000000140000000-0x000000014013E000-memory.dmp family_meduza -
Meduza family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2544 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\International\Geo\Nation xP87Qjz7KG.exe -
Executes dropped EXE 2 IoCs
pid Process 2336 xP87Qjz7KG.exe 2964 xP87Qjz7KG.exe -
Loads dropped DLL 2 IoCs
pid Process 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 2336 xP87Qjz7KG.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 8 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2336 set thread context of 2964 2336 xP87Qjz7KG.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2544 powershell.exe 2964 xP87Qjz7KG.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe Token: SeDebugPrivilege 2544 powershell.exe Token: SeDebugPrivilege 2964 xP87Qjz7KG.exe Token: SeImpersonatePrivilege 2964 xP87Qjz7KG.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2544 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 30 PID 2656 wrote to memory of 2544 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 30 PID 2656 wrote to memory of 2544 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 30 PID 2656 wrote to memory of 2544 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 30 PID 2656 wrote to memory of 2336 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 32 PID 2656 wrote to memory of 2336 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 32 PID 2656 wrote to memory of 2336 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 32 PID 2656 wrote to memory of 2336 2656 306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe 32 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 PID 2336 wrote to memory of 2964 2336 xP87Qjz7KG.exe 33 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 xP87Qjz7KG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe"C:\Users\Admin\AppData\Local\Temp\306c35f0a8b13eb8d3ff43f0fe031c9b2d008fddebe501e47e080111ebbb9712.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABiADgAMwBPAFMAOQBrAFcAcwBtAFwAeABQADgANwBRAGoAegA3AEsARwAuAGUAeABlACcA2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\b83OS9kWsm\xP87Qjz7KG.exe"C:\Users\Admin\AppData\Local\Temp\b83OS9kWsm\xP87Qjz7KG.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\b83OS9kWsm\xP87Qjz7KG.exeC:\Users\Admin\AppData\Local\Temp\b83OS9kWsm\xP87Qjz7KG.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2964
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5629ac1492f98853856fee836f3503a96
SHA18146b497066e621a9e33addb238447e73ddb934b
SHA2563eb15b4493bb204a384aa72714a8137b00608f97af9075ea2ae0aa8a479a9b29
SHA512f993c992ebe12ccb11cff04ebf9838c9b56581c1d2febdd380dcf6d9620936b09a7299fa01cf19ca69f157caff9e3c89835330c49c9aa98448596f475648e101