Analysis
-
max time kernel
86s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
11-12-2024 13:51
General
-
Target
Polysy_Launcher.exe
-
Size
199KB
-
MD5
de1cac479c4e6835736353a50f9971bb
-
SHA1
29f661c7966146e01c520ed986248649596f0604
-
SHA256
738913f52e0c4028bceecf7d81c446fa4319519729d227cf5d4eeabd78f472c2
-
SHA512
a411aa5df40f9fd69afbde612f32ac2c44bb18c7e277e8fb126d55ecbc3a024b8ef5b6515c738d75e0b7c436f33f6e8d6673930a6e654fbc72276909d9cce9ef
-
SSDEEP
384:gjLWLV6hIElJtDINwNfyPI4HRs6AuOow60IIIaebvokSA2Sr6XOxukts1q1zk/zy:9LkteVlHR7VskidgZYcV69izh
Malware Config
Signatures
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 1 IoCs
-
Meduza family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Polysy_Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Polysy_Launcher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\vvz54tfj.b21.exe"C:\Windows\Temp\vvz54tfj.b21.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\Temp\emuzu1r2.dfe.exe"C:\Windows\Temp\emuzu1r2.dfe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
Filesize
18KB
MD5c34c4b7209eef19b446e1b8a322adc85
SHA17e70bd31a42f79fb135bb378a4f92048f7a9427d
SHA256f79de630529c5ed24bbe0f33cd2f353d34a6f2362a89425c61d5a98027bb4496
SHA512647679cafe112956bce6e861be0ef39f3194f1dad8027073446a2b6d391376ad7e3cb360699c7b4bf1818872f6c8507266bb89a3c8e72c96b6bf8f1ed04a92d2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.2MB
MD5bee040fc0caf73ee0cb2e55d4c703f22
SHA16bf7f1fa9dcf930190cabfba9abde2e7faab486f
SHA256940d413dd95bc28d5c724d814f2cd1ecca005d2cb58ed28788d9c07d962d829b
SHA512ec45afc4a8626dc813462a3c65b57a75f96233e9e66a0d9d60953fa2e29ec1a1c48c9ccf00f8f0e0ad3ff37e8c98c673c5b2309ff77475896ec57897d73551b2
-
Filesize
224KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
208KB
-
Filesize
600KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
656KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
84KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
3.3MB