Analysis
-
max time kernel
116s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
gta_online_modmenu2.8.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
gta_online_modmenu2.8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
gta_online_modmenu2.8.exe
-
Size
692.3MB
-
MD5
7a0775e3b7824f08f45b0d330d2fb85a
-
SHA1
65aa9479bad9f3f272d7ba13196e614ada3136b0
-
SHA256
498c5a2baf821f1b8f867bdfddbef15949188286634f1bed85f7d9bfd384f3a5
-
SHA512
4963154a1729e9585a1a5ad93b30c688b302f707a14bb010d138e26f7ac28a50aa396c82df94edca1fc8c2f983ceafa9a806d4e8954b06326ed60161af599c8e
-
SSDEEP
6144:WvhV7it3d5f4AVB9YLex21fb65XbiDcxs/vp3sFLIlGWMV2Tebx2ibFD6204VU:wOvSAz97u0RxO53GDUK5Dk
Score
10/10
Malware Config
Extracted
Family
meduza
C2
45.130.145.152
Attributes
-
anti_dbg
true
-
anti_vm
true
-
build_name
SEO2.0
-
extensions
.txt; .doc; .xlsx
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza Stealer payload 2 IoCs
resource yara_rule behavioral2/memory/3520-17-0x00000204865C0000-0x0000020486701000-memory.dmp family_meduza behavioral2/memory/3520-24-0x00000204865C0000-0x0000020486701000-memory.dmp family_meduza -
Meduza family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation gta_online_modmenu2.8.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe -
Executes dropped EXE 1 IoCs
pid Process 3520 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 37 api.ipify.org 38 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 3520 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe 3520 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4940 gta_online_modmenu2.8.exe Token: SeDebugPrivilege 3520 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe Token: SeImpersonatePrivilege 3520 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe Token: SeDebugPrivilege 3736 taskmgr.exe Token: SeSystemProfilePrivilege 3736 taskmgr.exe Token: SeCreateGlobalPrivilege 3736 taskmgr.exe Token: 33 3736 taskmgr.exe Token: SeIncBasePriorityPrivilege 3736 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe 3736 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4940 wrote to memory of 3520 4940 gta_online_modmenu2.8.exe 99 PID 4940 wrote to memory of 3520 4940 gta_online_modmenu2.8.exe 99 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gta_online_modmenu2.8.exe"C:\Users\Admin\AppData\Local\Temp\gta_online_modmenu2.8.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\32e3a6f4-a74f-4abd-af76-7dee0c9de462\b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe"C:\Users\Admin\AppData\Local\Temp\32e3a6f4-a74f-4abd-af76-7dee0c9de462\b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3520
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\32e3a6f4-a74f-4abd-af76-7dee0c9de462\b22d8fb9-1fc7-4f22-9cd9-f399873b7b46.exe
Filesize3.2MB
MD57e8824d7700d40a1350bc4aa4daa942b
SHA14600574062ae904db4664aab72156321543afd95
SHA2564d457d796d0a9fed7a8d460bf18a4027f622bee27f451cc98cfb5d0a5075c058
SHA512d2ab6ec3f004dde2e60948eb0d9f8b159fe1cb50156c87a17442bcbdc1c585d75fd05aa25e4c0d7476a55d7132a882dd6e8286ca68b9f47c5b3748f91416905a