meduza | b5860aa704760ecaa8cb40c378c35dbd0c1d8b29d4d6b5eb9b97fad1dfff27b5

Analysis

max time kernel
96s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit_8.13.9.exe
Size

98KB
MD5

fe9d7b49dab665c66f2462ac58913202
SHA1

3fa3a12f014e2ca04972c6ea2cfb439662eef06f
SHA256

b5860aa704760ecaa8cb40c378c35dbd0c1d8b29d4d6b5eb9b97fad1dfff27b5
SHA512

bf6fe93ffdfcae97b480c975c0477f58157ac0551dd0c2db53f5452fbb5be23316bf0498350359447c13d9bcedfbaf44722af6edb6f8c4bad06780b2da956d9a
SSDEEP

3072:wVtPS5z1wveHYI9zcRgPS5z1wveHYI9SG6mz:wVA6ZICR36ZIx

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Extracted

Family

meduza

147.45.44.228

Attributes

anti_dbg
true
anti_vm
true
build_name
424
extensions
none
grabber_max_size
1.048576e+06
links
none
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1288-15-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral2/memory/1288-18-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral2/memory/1288-19-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral2/memory/1288-17-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral2/memory/1288-51-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza

Meduza family
meduza
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	JJSploit_8.13.9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	cfg.exe

Executes dropped EXE 3 IoCs

pid	Process
368	cfg.exe
1288	cfg.exe
4840	jjsploit.exe

Loads dropped DLL 3 IoCs

pid	Process
4840	jjsploit.exe
4840	jjsploit.exe
4840	jjsploit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
11	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org
21	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 1288	368	cfg.exe	85

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JJSploit_8.13.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jjsploit.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1056	cmd.exe
4136	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4136	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1288	cfg.exe
1288	cfg.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	JJSploit_8.13.9.exe
Token: SeDebugPrivilege	1288	cfg.exe
Token: SeImpersonatePrivilege	1288	cfg.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 368	1620	JJSploit_8.13.9.exe	84
PID 1620 wrote to memory of 368	1620	JJSploit_8.13.9.exe	84
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 368 wrote to memory of 1288	368	cfg.exe	85
PID 1620 wrote to memory of 4840	1620	JJSploit_8.13.9.exe	89
PID 1620 wrote to memory of 4840	1620	JJSploit_8.13.9.exe	89
PID 1620 wrote to memory of 4840	1620	JJSploit_8.13.9.exe	89
PID 1288 wrote to memory of 1056	1288	cfg.exe	96
PID 1288 wrote to memory of 1056	1288	cfg.exe	96
PID 1056 wrote to memory of 4136	1056	cmd.exe	98
PID 1056 wrote to memory of 4136	1056	cmd.exe	98

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cfg.exe

C:\Users\Admin\AppData\Local\Temp\JJSploit_8.13.9.exe
"C:\Users\Admin\AppData\Local\Temp\JJSploit_8.13.9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\cfg.exe
  "C:\Users\Admin\AppData\Local\Temp\cfg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Users\Admin\AppData\Local\Temp\cfg.exe
    "C:\Users\Admin\AppData\Local\Temp\cfg.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:1288
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\cfg.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\Windows\system32\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4136
- C:\Users\Admin\AppData\Local\Temp\jjsploit.exe
  "C:\Users\Admin\AppData\Local\Temp\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cfg.exe

Filesize
3.1MB

MD5
8edff3f58df24723f285aa113ba3da4b

SHA1
d9ffc44beab78fcf6910e6a55d9b888183967e05

SHA256
82c1101855adff990a1a5e6dcf6bdc32103088007b1f5f1ea52d8e765fbb3ad3

SHA512
a4b66616ee05f8eb2bf9bb091d3eb0d960fd3eadab3efde6b5121ff1eac90da888e7582a7f409b00ff0aa2642d490d71a4d0ca12705116691db16130e08dfe9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jjsploit.exe

Filesize
5.7MB

MD5
87bece829aec9cd170070742f5cc2db7

SHA1
0a5d48a24e730dec327f08dfe86f79cc7991563e

SHA256
88a19d3e027158e8c66d5068303532a0d56a700f718db80aa97e5e44f39bf4a4

SHA512
198c80d4b430a38ac597ff9023128cdbc9d2891097beef239721c330c75a412c0bdb87a4bfb0609db94f320655f3df1fab7d885843c0af40687e46ddcc88c9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscCAD4.tmp\StartMenu.dll

Filesize
7KB

MD5
d070f3275df715bf3708beff2c6c307d

SHA1
93d3725801e07303e9727c4369e19fd139e69023

SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscCAD4.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscCAD4.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
memory/1288-15-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/1288-18-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/1288-19-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/1288-17-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/1288-51-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/1620-6-0x000000000A2B0000-0x000000000A2BE000-memory.dmp

Filesize
56KB

Download
memory/1620-5-0x000000000A2E0000-0x000000000A318000-memory.dmp

Filesize
224KB

Download
memory/1620-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/1620-4-0x0000000009A60000-0x0000000009A68000-memory.dmp

Filesize
32KB

Download
memory/1620-37-0x0000000074B30000-0x00000000752E0000-memory.dmp

Filesize
7.7MB

Download
memory/1620-3-0x0000000074B30000-0x00000000752E0000-memory.dmp

Filesize
7.7MB

Download
memory/1620-2-0x0000000074B30000-0x00000000752E0000-memory.dmp

Filesize
7.7MB

Download
memory/1620-1-0x0000000000380000-0x000000000039E000-memory.dmp

Filesize
120KB

Download