meduza | e4b3eb482bd3d7c29067eacd1e52a0256e49cc1560889822f81f34202c6bd6e5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crack.exe
Size

2.5MB
MD5

713454ca909efaf3a83b636423a6c248
SHA1

6c197870b9646b90f5b55bdcd4cfd07019864e98
SHA256

9d1701e0510ea2a76a1292999d89627ba30384bcb7eacc3000e331ba728bf8ad
SHA512

8a31b7fdfe7a4d1c21f7af401e14c7ae7b420e66bab2fc8310c1341fc8b559a80a12b6b3fb1544358f1e505eb931e466abdf1bd3289618846c4a9167b789a80b
SSDEEP

24576:xf2KQ7MvYPh0lhSMXlJu78bG8AQs7QZqxwB42EyuzCBorM5c9ech:tpHvZM78b9Ab7aTEZzwoN

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Mazti
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
3.145728e+06
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2556-0-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-2-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-7-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-8-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-9-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-5-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-4-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-3-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-13-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-15-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-11-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza
behavioral1/memory/2556-10-0x0000000001B80000-0x0000000001D7A000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Crack.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation	Crack.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Crack.exe

description	pid	Process
Token: SeDebugPrivilege	2556	Crack.exe
Token: SeImpersonatePrivilege	2556	Crack.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Crack.exe

description	pid	Process	procid_target
PID 2556 wrote to memory of 2728	2556	Crack.exe	30
PID 2556 wrote to memory of 2728	2556	Crack.exe	30
PID 2556 wrote to memory of 2728	2556	Crack.exe	30

C:\Users\Admin\AppData\Local\Temp\Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Crack.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2556 -s 416
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-0-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-2-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-7-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-8-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-9-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-5-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-4-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-3-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-13-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-15-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-11-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download
memory/2556-10-0x0000000001B80000-0x0000000001D7A000-memory.dmp

Filesize
2.0MB

Download