Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 14:04
General
-
Target
Last_Update.zip
-
Size
115.1MB
-
MD5
b77f2704c0b2d688d8d261ba9529ebe4
-
SHA1
da100b659aa3c02468ff48a1417e168e4fc5513f
-
SHA256
83cb8837a462f00a5d0e8327ff13c70eaa1f500d16dadacbdad79c7f21691c01
-
SHA512
d78154c6e09e789c98c1a29ff55aafbbc49f6baf77b5a1f220b48cf85f5603e1175d0c9f6ceb00598b7d49bd896b0202521e80f1349a3cdea2abd9375f26941d
-
SSDEEP
3145728:PEZRDJf7jLrjWKrpbT9XmdBCohjY/J2JCiC2ZKbKIsFfsfgSw6:PEZRhWKrZx+hjSJF2s25NsISN
Malware Config
Extracted
meduza
45.130.145.152
-
anti_dbg
true
-
anti_vm
true
-
build_name
Santa
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
true
Signatures
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 41 IoCs
-
Meduza family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Last_Update.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Cheat.exe"C:\Users\Admin\Desktop\Cheat.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
C:\Users\Admin\Desktop\Cheat.exe"C:\Users\Admin\Desktop\Cheat.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b87272f76ea9b9af385c741368d0642b
SHA171d3fb857ce073df5af74e07f2b6f40a931bcb40
SHA2562ce934bde9b37b4aaa20431ef2ea9da7d437704351e552498b2f1fb789ba31d7
SHA5124cf30fd459caa546cbeeaa578831c5d4bdd8e90e08e1123c362266f6453d4265d1ff8c5cad2ae742b5c7a58a04bb75cbf98a26118ffde81f7195e168e8661de6
-
Filesize
23KB
MD55e54cb9759d1a9416f51ac1e759bbccf
SHA11a033a7aae7c294967b1baba0b1e6673d4eeefc6
SHA256f7e5cae32e2ec2c35346954bfb0b7352f9a697c08586e52494a71ef00e40d948
SHA51232dcca4432ec0d2a8ad35fe555f201fef828b2f467a2b95417b42ff5b5149aee39d626d244bc295dca8a00cd81ef33a20f9e681dd47eb6ee47932d5d8dd2c664
-
Filesize
150KB
MD5423671a408eedd5e51f4d4f6a3de4589
SHA17a96a2c6e2381e78bdd152e3caef75146460f488
SHA256b62fab3be134e7765720c0eb579be5a65ae719771b1e39c14ac39958d554b90e
SHA5124e9aa8c9ff248d4ec86d79b8515dbe51fa30aa5b28124a2c1872270c30e7887c1d49c573116237f393c29ef431b97110212fdac9d3a27134b6effdc5d373c11c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.6MB
MD5d17b18e5820ddb3e2515fa0562ab484e
SHA11dcb957dd975882a595f0c6475e0ddde5b44b6ed
SHA256824b69c0796a480763a9d5c49154060c2f39c1782714b4b1054e715b49dd1489
SHA5127342e4a58814d281a55704dffad23250a17928eaf0c171d2fb8c95320c413f3dc84c5f0a3486bff0fdbee26b6b4c2ec25199185467949e60cf59bdec677f1438
-
Filesize
18B
MD51f2cb924ab7c6c964d77c6a61098ff57
SHA1efa42f9dc9d3c95179613c1afabd7906e86d4a42
SHA25616f191e6355d32099b7f25945270f621bef6f92b3e5c1da178bc21e60912b470
SHA5127aa55921af23ae4b9456cd3317391c8d8b927e266ef41a0e41c89a68798d7c53c62f730ee71977f3d465be3c8510a68e5ebabde73ea183b4c94af867daa209a7
-
Filesize
13KB
MD55331bac43e1da20a9cf5b9bd4ee4f83a
SHA183f5cd92320abc367e4215f98c78ecaedec5f56b
SHA256fba02491e20b9de7ed50476145904f4a130aa2ad6de15c4e55b63368263f6fe8
SHA5120806679ecb8c5ea459092cbf7d5b030ed41eb596399f95770f5b4e95b3a70f46b8099c29cbfab292398b0bc03e76b0ad049a29ecb49b7aff81bca84dede4d2a8
-
Filesize
13KB
MD53666ab3b60d527211ba53203bef9f911
SHA1f63f946eb36414c845b4faa826379b5d84fd8f11
SHA2569cfec87cb1fe913126aa50811a09d34f494d9917b2958ed2b9056744aed26a35
SHA512bb5c4515ae0fbf10094e638ac6ddd033a6c72398ded656e02448aaff77e4c5c936a7584fd66b9838e66edd5b85d0c7de3dd456422c3a0a9348b87d2b24c47eed
-
Filesize
25B
MD5975f1a1e9506cb4ecf67908349f93d70
SHA1b4ef860be2eb4b48beec790fa24aa93e75e526d6
SHA256b574e73c5c3f65df0099e958fc5b9959738daae7b2b8854e78815ccb08f564a8
SHA512aee94612c838beed21be31f04482440a0357f5de9d1e426cc7ef0dd2deff9c15a912d19b0e83c10cfbeea044dcdf5b45e582a16e8a0e5027a133c885dde602f0
-
Filesize
36KB
MD5839cdfa87b30840faaa1d05f3f0014b6
SHA117c218e688e8c3176869dcab452ca362404f8bc6
SHA256c53071322a5d6e161ef5105fbb5ee4129a848e0bcb1ecb0dbba11d351ad1cf13
SHA512ade8eb1e2a1e1dfe3ea7b3f0b7fe28b06e3996a39b4d17164708d434f07967fd8809418ed5a0c4ff1f8b0fe0bc276e8c773e030f361fe9fb09d75e3e2e607550
-
Filesize
17KB
MD5015500391eecb049e857b8b354bb8aa9
SHA1d4a886b73c656a3aec5e31364281ac1005acfd05
SHA25680a47b479eaa4807a7a0fad4398b65fa830542802e00b9293660107a091d8aae
SHA512977aeb8ed179393b0ad06ec08e78edcfb220c60ff123b5bed8b444f102fc8279579cadbc287cd3dc8d29054c7d4f903eafcd6640df251b8de9675b7dc6c17b72
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8KB
-
Filesize
16.0MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB