meduza | 1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 18:37

Target

1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe
Size

2.5MB
MD5

54bb597adcd52329b24fa873b2f64f02
SHA1

658df16d5114d59f38365e8646f98b857dea0a38
SHA256

1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010
SHA512

79360a9c4911bf73a9f9903b87bcf5440c49d15a85611eb210ae2397e22d1086df363d75d65049a81a0a54fa508deee8b0a445e0a2d08ae87edf0849b030a939
SSDEEP

49152:wUK7u56sAlGcS9SczGo2IyocnGtFH1S2SY0pFBK3dQqgTLrhyphs84QImmAjc9:VKKIsA+SU7HgBJXK3SnLrhyph9jI

Score

10^/10

meduza stealer upx

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza
Meduza family
meduza

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2128-0-0x000000013F030000-0x000000013F7A0000-memory.dmp	upx
behavioral1/memory/2128-1-0x000000013F030000-0x000000013F7A0000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 10 IoCs

Suspicious use of SendNotifyMessage 10 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2128	1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 844	2128	1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe	29
PID 2128 wrote to memory of 844	2128	1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe	29
PID 2128 wrote to memory of 844	2128	1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe	29

C:\Users\Admin\AppData\Local\Temp\1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe
"C:\Users\Admin\AppData\Local\Temp\1409d0bc4bf52236303eab2d1823c4bc23d5d84ed00c1027ea73083496459010.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 312
  2⤵
  PID:844

memory/2128-0-0x000000013F030000-0x000000013F7A0000-memory.dmp

Filesize
7.4MB

Download
memory/2128-1-0x000000013F030000-0x000000013F7A0000-memory.dmp

Filesize
7.4MB

Download