Analysis
- max time kernel
43s - max time network
51s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
01/12/2024, 09:25
General
- Target Solara.exe
- Size 661.5MB
- Sample241201-ldvaeayqdt
- SHA256 8ff929bb2e7cc8033cfa6927a7634d8c5cf6582f3be8a41bbc430b99ebbc64f5
Malware Config
Extracted
-
meduza
-
45.130.145.152
-
anti_dbg
true
-
anti_vm
true
-
build_name
Work
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
- Meduza
Meduza is a crypto wallet and info stealer written in C++.
- Meduza Stealer payload 2 IoCs
- Meduza family
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2968 -s 6563⤵
- Loads dropped DLL
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
installer.exe
memory/2100-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp
memory/2100-1-0x0000000000370000-0x0000000001370000-memory.dmp
memory/2100-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp
memory/2100-3-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp
memory/2100-4-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp
memory/2100-5-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp
memory/2100-12-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp
memory/2100-17-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp
memory/2968-11-0x0000000001BC0000-0x0000000001CFE000-memory.dmp
memory/2968-16-0x0000000001BC0000-0x0000000001CFE000-memory.dmp