Analysis
-
max time kernel
100s -
max time network
102s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
29-11-2024 15:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
19 signatures
150 seconds
General
-
Target
setup.exe
-
Size
3.6MB
-
MD5
3b7448485ce62f2ef5325b9e5087594f
-
SHA1
90262dcadd727ca8f6205d8d66667261d4f99336
-
SHA256
d356579db6e7184d800db8c6cd9463f6c4479ec4f60b96a83000ecc078c7b6c6
-
SHA512
f4520836d6924769341756ade4c7e5571f3dee051d4351c86a1380883e8456cd6e7d45f3ba985ea4abe0fab74afe7486786379cb9a626b5a0e51c40f47d935e9
-
SSDEEP
49152:0QusxfsCkQfaO6uj4+3jfS8Q710uNbI/a0oldr6op:5+p
Score
10/10
Malware Config
Extracted
Family
meduza
C2
109.107.181.162
Attributes
-
anti_dbg
true
-
anti_vm
true
-
build_name
6
-
extensions
none
-
grabber_max_size
1.048576e+06
-
links
none
-
port
15666
-
self_destruct
true
Signatures
-
Meduza Stealer payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/4928-0-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-2-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-11-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-14-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-15-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-13-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-8-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-7-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-6-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-5-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-1-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-20-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-22-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-17-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-29-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-30-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-63-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-76-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-69-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-82-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-84-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-93-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-77-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-94-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-73-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-72-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-64-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-58-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-54-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-52-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-48-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-46-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-45-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-42-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-40-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-33-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-57-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-51-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-39-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-36-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza behavioral1/memory/4928-34-0x0000000140000000-0x00000001401FA000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setup.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation setup.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
setup.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 api.ipify.org 22 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
setup.exedescription pid Process procid_target PID 1184 set thread context of 4928 1184 setup.exe 80 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 4912 cmd.exe 4008 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
setup.exetaskmgr.exepid Process 4928 setup.exe 4928 setup.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
setup.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 4928 setup.exe Token: SeImpersonatePrivilege 4928 setup.exe Token: SeDebugPrivilege 3468 taskmgr.exe Token: SeSystemProfilePrivilege 3468 taskmgr.exe Token: SeCreateGlobalPrivilege 3468 taskmgr.exe Token: 33 3468 taskmgr.exe Token: SeIncBasePriorityPrivilege 3468 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe 3468 taskmgr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
setup.exesetup.execmd.exedescription pid Process procid_target PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 1184 wrote to memory of 4928 1184 setup.exe 80 PID 4928 wrote to memory of 4912 4928 setup.exe 88 PID 4928 wrote to memory of 4912 4928 setup.exe 88 PID 4912 wrote to memory of 4008 4912 cmd.exe 90 PID 4912 wrote to memory of 4008 4912 cmd.exe 90 -
outlook_office_path 1 IoCs
Processes:
setup.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe -
outlook_win_path 1 IoCs
Processes:
setup.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4928 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4008
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3468