meduza | e9772d2d021c030a2a8685fcffc721a2a0fb94a65b13d097725e6a1e5419e395

General

Target

Panel.exe
Size

526.9MB
MD5

6a683ece84181f6b32980177840d3e24
SHA1

1116d53133e9c010ed98116ede1a29927f7b0920
SHA256

e9772d2d021c030a2a8685fcffc721a2a0fb94a65b13d097725e6a1e5419e395
SHA512

14a46fcbe64ce22ed628572eb02d2fd8ec35d2fcf09073910c05819526adc3fa02930b1d7bb88462c5c72fd87194779f90e867e668b49532fcc6ff4832c9e8d7
SSDEEP

98304:0JxFqrqnIGHYeUt7wSTsEitaAo4N/nl3x0NlBuQa3HUQ:wxFqrqnwtwSccAoKl3fQa3

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Student
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
3.145728e+06
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 13 IoCs

resource	yara_rule
behavioral1/memory/2568-16-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-24-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-21-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-23-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-22-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-30-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-27-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-26-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-29-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-20-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-18-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-17-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza
behavioral1/memory/2568-15-0x0000000001E70000-0x000000000206A000-memory.dmp	family_meduza

Meduza family
meduza
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\International\Geo\Nation	b1263bed0d4e45c5a5cd29b89b5c7557.exe

Executes dropped EXE 2 IoCs

pid	Process
2568	b1263bed0d4e45c5a5cd29b89b5c7557.exe
1748	a4cd1c096b554a0596257ff735fbfcf2.exe

Loads dropped DLL 5 IoCs

pid	Process
3036	Panel.exe
3036	Panel.exe
1864	WerFault.exe
1864	WerFault.exe
1864	WerFault.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	Panel.exe
Token: SeDebugPrivilege	2568	b1263bed0d4e45c5a5cd29b89b5c7557.exe
Token: SeImpersonatePrivilege	2568	b1263bed0d4e45c5a5cd29b89b5c7557.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2568	3036	Panel.exe	30
PID 3036 wrote to memory of 2568	3036	Panel.exe	30
PID 3036 wrote to memory of 2568	3036	Panel.exe	30
PID 3036 wrote to memory of 1748	3036	Panel.exe	32
PID 3036 wrote to memory of 1748	3036	Panel.exe	32
PID 3036 wrote to memory of 1748	3036	Panel.exe	32
PID 2568 wrote to memory of 1864	2568	b1263bed0d4e45c5a5cd29b89b5c7557.exe	33
PID 2568 wrote to memory of 1864	2568	b1263bed0d4e45c5a5cd29b89b5c7557.exe	33
PID 2568 wrote to memory of 1864	2568	b1263bed0d4e45c5a5cd29b89b5c7557.exe	33

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\b1263bed0d4e45c5a5cd29b89b5c7557.exe
  "C:\Users\Admin\AppData\Local\Temp\b1263bed0d4e45c5a5cd29b89b5c7557.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2568 -s 656
    3⤵
    - Loads dropped DLL
    PID:1864
- C:\Users\Admin\AppData\Local\Temp\a4cd1c096b554a0596257ff735fbfcf2.exe
  "C:\Users\Admin\AppData\Local\Temp\a4cd1c096b554a0596257ff735fbfcf2.exe"
  2⤵
  - Executes dropped EXE
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a4cd1c096b554a0596257ff735fbfcf2.exe

Filesize
2.6MB

MD5
5ad98066bfaea71873af260814cdebb0

SHA1
5dc890fd83e13d1b3b9ffc8b9e691bf5923fe7d4

SHA256
bec45a7561b438237598f772b08e4e67f480e2330619fb3e7cd175156627c5f8

SHA512
4373e339b09fef72e8da394933b42a04ff4c9b1e31636c0cad6a0fc8d60d7a4e23b43d744f3725fb506078fdb2521879c785978e1aef066898eb3762a72b262e

Download Submit
\Users\Admin\AppData\Local\Temp\b1263bed0d4e45c5a5cd29b89b5c7557.exe

Filesize
2.6MB

MD5
41f92168b17f6f6e3f0c2dd847b8790c

SHA1
d72086c8d7cf22ee4a212a8aafbf2c1cfbb68db4

SHA256
4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc

SHA512
51993dd5aed96c4dc4863ad9126be8f8e651b363cde9042561fc9fa1c9f19febacc786c9dbde8c148cd6eaf28b536e3056582e5413e507f67d4981ddde8a001f

Download Submit
memory/1748-37-0x0000000000250000-0x00000000002D0000-memory.dmp

Filesize
512KB

Download
memory/2568-26-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-29-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-15-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-17-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-18-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-20-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-27-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-16-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-24-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-21-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-23-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-22-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/2568-30-0x0000000001E70000-0x000000000206A000-memory.dmp

Filesize
2.0MB

Download
memory/3036-2-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-3-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/3036-4-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-8-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-7-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-6-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-5-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/3036-1-0x0000000000CD0000-0x0000000001CD0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing