Analysis

  • max time kernel
    69s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 16:16

General

  • Target

    https://github.com/hugodq/Wave-executor/releases/tag/Download

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    6

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 3 IoCs
  • Meduza family
  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/hugodq/Wave-executor/releases/tag/Download
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff997246f8,0x7fff99724708,0x7fff99724718
      2⤵
        PID:4076
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        2⤵
          PID:2900
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1804
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
          2⤵
            PID:2096
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
            2⤵
              PID:3012
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
              2⤵
                PID:3632
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
                2⤵
                  PID:4424
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1588
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
                  2⤵
                    PID:1232
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                    2⤵
                      PID:4556
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
                      2⤵
                        PID:1116
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
                        2⤵
                          PID:2844
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2768
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
                          2⤵
                            PID:396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8704268644948815626,4315727910276999907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
                            2⤵
                              PID:2508
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2292
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:576
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:3120
                                • C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe
                                  "C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe"
                                  1⤵
                                  • Suspicious use of SetThreadContext
                                  PID:4308
                                  • C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe
                                    C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe
                                    2⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5148
                                • C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe
                                  "C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe"
                                  1⤵
                                  • Suspicious use of SetThreadContext
                                  PID:5904
                                  • C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe
                                    C:\Users\Admin\Downloads\Setup5.0\setup7.0\setup7.0.exe
                                    2⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5920

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  85ba073d7015b6ce7da19235a275f6da

                                  SHA1

                                  a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                  SHA256

                                  5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                  SHA512

                                  eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                  SHA1

                                  010da169e15457c25bd80ef02d76a940c1210301

                                  SHA256

                                  6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                  SHA512

                                  e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  8545e15810722941240e02d596fd2820

                                  SHA1

                                  2cb100c05800ea41f90cc20cf6406973052e2d38

                                  SHA256

                                  15e688876604f8280b0bf5c8f707ab0b14c5ef62060b594632c067c0a92ba5e5

                                  SHA512

                                  88042ed23bf5a90eb5fe76a3280986168e382ed6e0d3fe7ac7c38f0ddd273e07da05d197a3c4ed7250feb2a6e1c754fa858f3e8a7ade411598bc702d7ca4e927

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  496B

                                  MD5

                                  1b92794633aaa7d8ca83e408ef516a36

                                  SHA1

                                  4ae0678d6cf8abedb3e9819fc9d7d715d3f72bb6

                                  SHA256

                                  0ff76dc871bd6e59abe386781ef988b4c8d734bca726a4d1eb556d3d78f1e7e0

                                  SHA512

                                  698bb4adf1932dd48fbffb344b0053b9dc753b97a92d88a26341e0c3b0fa2e03481c5193bd2b4a1caaa2aa2f00e41eae73c53aaadc1ac6bb8be17d0f229a61bb

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  bc3be54e65a977a1c470bafa67d5b090

                                  SHA1

                                  337690161319acad7c1c58b28087972c57720ecb

                                  SHA256

                                  b51713d49d0b8b7e47b8e67b935109b5f4abc98dccfe2a465b2a6517fba84c5b

                                  SHA512

                                  f4a549f0a0da4d62a8cfd99527fbfd02173e8cfe5e53a87de4548905ab1a62ad0160054a8dba9cecfe33bf904d82346ed6f083f929df080b61e3c888e3581704

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  d261c47da2ecf9e91d1ff9844e8f2ace

                                  SHA1

                                  253f62d76f00822aa2fac6671de520e735c0a218

                                  SHA256

                                  a2ac3b66e648171626ef2586acd7032b6635f0d166619512804f1fb7011fe213

                                  SHA512

                                  a13a28ac9694648f07bf66ad01976ea3ded9433085a0999a6d495bb4cbf2ca7c84d3417050d16868a693a991df97d5715b07deaa758b4cd9025bd2d8c0bbd3e0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  c0863e26cbc318ae5f66831d28c4501f

                                  SHA1

                                  0b414c56935ca25afe58f45fa8a12284398f8c01

                                  SHA256

                                  cb08bd07b7a6f86e1e3f5e220323ac24bcf1a64b8c8c96315d5dd04a789d996c

                                  SHA512

                                  3d308dc453ee00dd291deaa55a714d16412ee0a4994770eff8d492080e6636350e80bddb1ae9d941829af4f4ff0d3ffb398a95972b4f100357fa4e0347c69256

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  874B

                                  MD5

                                  e36119e65ea78e6e9680804aa9c958d9

                                  SHA1

                                  db67da68702bf38746627447042d20d4e434313b

                                  SHA256

                                  3afbc29b462f8f711016111f7de024b3297a02a97f22002abb6613c8ef3499ba

                                  SHA512

                                  35d2ec87f4c3f0a8b809eee2cc7613bbdc67f38cd56a62249bdf4807d909b19df42cf757061f06ef176a131d2fccc99e0be4a2e11d1b7d1c74d896e5bd112eac

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587625.TMP

                                  Filesize

                                  874B

                                  MD5

                                  6aefa16cace88a494eaf5a67eb7570e5

                                  SHA1

                                  1aeacfddc4c1d41108b13bd564ebda474419d953

                                  SHA256

                                  557b644f1d929dc75c2600341061fa9c41f19686c6e068f13d63b9a3a6090cfc

                                  SHA512

                                  75e8cdcd63b7939b8df86f2e324d5f15fe9c4c91b8d173e7f9f5de19092c6fb12a3496e85acf5bfad151c3e3f05c3e3437a0f036a5dbc1977910ced3481a84c1

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  99bf2e7d1dd82caf67735145f42515de

                                  SHA1

                                  f31cae886f3a4ff18b20a7a7f06b2b44a19832ae

                                  SHA256

                                  37dd136310ff7400408623efa846e7cd3cde3421b9caa10017c7cbf584164bec

                                  SHA512

                                  94b1954760d27d7a86661e267afed910f647c6de0d9bf3c013ac52859b2990090416848a76de60de1124af1647e271ab1bcb95609b7760f43cfef62cd01e68c5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  fd5d3ea4aeaec278992fbc4a7732072c

                                  SHA1

                                  7ab38bd96893525c3e6192b7ac1634978c102f40

                                  SHA256

                                  88d2ed41c514d1a663febb04b8918ef92c5b7312d90438142f0f68583702a84a

                                  SHA512

                                  611932084f8ce5979c9b3d5869948a81f8f7002cb2664b4692428ba3b091d53033ae663515c7b7b043f24d1d5cdd6856e65541fd9550f19ab584c15cc99d8d84

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  c0525c569f059f802ee9d4d9a6df078c

                                  SHA1

                                  1d1a8e9d2363a403eed7ac99a85e70b3855d3d95

                                  SHA256

                                  33e90017771cb3d8fbc16dfb39f2b53876025fae63d4a8370a7dc8499039e749

                                  SHA512

                                  f7915178d86662cc2425924bbe6130921149e4904caad69f0369f44a87ef7d70f45b9b061c9d7ef1627e05f3063ec2d6321be4e4d31e04d32f0cb2c7c6441b15

                                • C:\Users\Admin\Downloads\Setup5.0.zip

                                  Filesize

                                  2.3MB

                                  MD5

                                  d7d4d1c2aa4cbda1118cd1a9ba8c8092

                                  SHA1

                                  0935cb34d76369f11ec09c1af2f0320699687bec

                                  SHA256

                                  3a82d1297c523205405817a019d3923c8f6c8b4802e4e4676d562b17973b21ea

                                  SHA512

                                  d96d6769afc7af04b80a863895009cd79c8c1f9f68d8631829484611dfce7d4f1c75fc9b54157482975c6968a46e635e533d0cad687ef856ddc81ab3444bb553

                                • memory/5148-190-0x0000000140000000-0x000000014013E000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/5148-191-0x0000000140000000-0x000000014013E000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/5920-306-0x0000000140000000-0x000000014013E000-memory.dmp

                                  Filesize

                                  1.2MB