Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
12-12-2024 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Crosshair-X.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
21 signatures
150 seconds
General
-
Target
Crosshair-X.exe
-
Size
3.1MB
-
MD5
15e819fc012fff88745c333ac4b651de
-
SHA1
964fc61c021da23a1b76287d2a7121c1ce7177f1
-
SHA256
d19223493c30665def28f1fce695855fb2acead50e619b1da71f4639e493c769
-
SHA512
194161c76e168e4b51414e900d70bf6c2557a59a399a5a82f950be469caec35129594c28feae2f6037de3f2553a2f9c2d78ef2b0da73983800c06dacc92d64f1
-
SSDEEP
24576:SBvf9dnsfWOm5iekSsiBDxRunqr2x6bQy6iCXAe9FJKIPWHkNGKDm8BU4K5YkVAO:uCWOnzAdy0i5tQItNrDmp4Wa
Score
10/10
Malware Config
Extracted
Family
meduza
C2
5.252.155.28
Attributes
-
anti_dbg
true
-
anti_vm
true
-
build_name
665
-
extensions
none
-
grabber_max_size
1.048576e+06
-
links
none
-
port
15666
-
self_destruct
true
Signatures
-
Meduza Stealer payload 5 IoCs
resource yara_rule behavioral1/memory/2492-2-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2492-1-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2492-3-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2492-0-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2492-10-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\Control Panel\International\Geo\Nation Crosshair-X.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1224 set thread context of 2492 1224 Crosshair-X.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2280 PING.EXE 4648 cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2280 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2492 Crosshair-X.exe 2492 Crosshair-X.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2492 Crosshair-X.exe Token: SeImpersonatePrivilege 2492 Crosshair-X.exe Token: SeDebugPrivilege 4016 taskmgr.exe Token: SeSystemProfilePrivilege 4016 taskmgr.exe Token: SeCreateGlobalPrivilege 4016 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 1224 wrote to memory of 2492 1224 Crosshair-X.exe 78 PID 2492 wrote to memory of 4648 2492 Crosshair-X.exe 80 PID 2492 wrote to memory of 4648 2492 Crosshair-X.exe 80 PID 4648 wrote to memory of 2280 4648 cmd.exe 82 PID 4648 wrote to memory of 2280 4648 cmd.exe 82 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Crosshair-X.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crosshair-X.exe"C:\Users\Admin\AppData\Local\Temp\Crosshair-X.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\Crosshair-X.exe"C:\Users\Admin\AppData\Local\Temp\Crosshair-X.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2492 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Crosshair-X.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2280
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4016
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1