Analysis

  • max time kernel
    35s
  • max time network
    44s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20-12-2024 10:45

General

  • Target

    Solara.exe

  • Size

    754.0MB

  • MD5

    6d2557890012c957faaae8d35a4f0e56

  • SHA1

    1225cd40742576895f74b42bdc18b3af21d96eef

  • SHA256

    b29da8d3e2117236d9f8af71bed0addf68093ccf61acad5a979b2531b0049310

  • SHA512

    145b3471f498d9579b466695407c03a3bd0fad9b98cabbdab9f34ee0ba534d4734fcdb1ce357b90e0de1ec8d9ded04f5576b06e94abed79601510d05cfc4d65a

  • SSDEEP

    98304:pJxFqrqnIGHYeUt7w8TsEitaAo4N/nl3x0NlBuQa3HUQLrFD:/xFqrqnwtw8ccAoKl3fQa3J

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    Oxoxox

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    3.145728e+06

  • port

    15666

  • self_destruct

    true

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 42 IoCs
  • Meduza family
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 4 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Users\Admin\AppData\Local\Temp\930abeccde19454198fb3466c9a2043f.exe
      "C:\Users\Admin\AppData\Local\Temp\930abeccde19454198fb3466c9a2043f.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:32
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\930abeccde19454198fb3466c9a2043f.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3268
        • C:\Windows\system32\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2384
    • C:\Users\Admin\AppData\Local\Temp\c9724a67b92345da9ef800ca61ed740c.exe
      "C:\Users\Admin\AppData\Local\Temp\c9724a67b92345da9ef800ca61ed740c.exe"
      2⤵
      • Executes dropped EXE
      PID:2352
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:4672
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\060bd452-65fd-4a6d-9354-f6e7461fea08.down_data

      Filesize

      555KB

      MD5

      5683c0028832cae4ef93ca39c8ac5029

      SHA1

      248755e4e1db552e0b6f8651b04ca6d1b31a86fb

      SHA256

      855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

      SHA512

      aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

    • C:\Users\Admin\AppData\Local\Temp\930abeccde19454198fb3466c9a2043f.exe

      Filesize

      2.6MB

      MD5

      7d822df39b176d6fd8cedf539ba0e95e

      SHA1

      0af3b8f8099b533e55112f5f7162ef8bfdbdd718

      SHA256

      9d94ec88ae8df58aaa9c15670724c23a34fee48b1e7c049745bb6046b28970bd

      SHA512

      62a7cc8ed18ca42eaf904b23302e653a4f6f5c0238a91b24f28c5c514f63e0df6d3225cf59ecadfba4989728e709946167cfb163b59fef93064b476314f7926d

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ir5tv31f.nrg.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\c9724a67b92345da9ef800ca61ed740c.exe

      Filesize

      2.6MB

      MD5

      2a045f1c2771df69aba71df4c648e7d8

      SHA1

      511264dafdae9bcced2679c5146c431937ae7409

      SHA256

      54ca3bdf5c29db04809899fd837a130e9653885a78c6600ea813158e88efd740

      SHA512

      84a0a8c76a75fb35e29e39dbd4f0c531d2f8457840deb732966c5cae792cd09e75332b232153426adfa80a26b550452cd6fb803d0be9442dc79382429aefb97c

    • memory/32-60-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-124-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-38-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-65-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-118-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-119-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-74-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-87-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-45-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-51-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-97-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-47-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-66-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-44-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-43-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-40-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-37-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-35-0x00000214BA190000-0x00000214BA191000-memory.dmp

      Filesize

      4KB

    • memory/32-34-0x00007FF9A6D00000-0x00007FF9A6F09000-memory.dmp

      Filesize

      2.0MB

    • memory/32-61-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-50-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-133-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-46-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-71-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-70-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-67-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-39-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-64-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-96-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-105-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-114-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-115-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-109-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-108-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-103-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-102-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-91-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-90-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-85-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-84-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-81-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-79-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-78-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/32-75-0x00000214BBCF0000-0x00000214BBEEA000-memory.dmp

      Filesize

      2.0MB

    • memory/2352-72-0x00007FF9A6D00000-0x00007FF9A6F09000-memory.dmp

      Filesize

      2.0MB

    • memory/2352-73-0x000001C4A3E80000-0x000001C4A3F01000-memory.dmp

      Filesize

      516KB

    • memory/3924-15-0x000002C3DC350000-0x000002C3DC35A000-memory.dmp

      Filesize

      40KB

    • memory/3924-13-0x000002C3DC4F0000-0x000002C3DC512000-memory.dmp

      Filesize

      136KB

    • memory/3924-14-0x00007FF985EB0000-0x00007FF986972000-memory.dmp

      Filesize

      10.8MB

    • memory/3924-16-0x00007FF985EB0000-0x00007FF986972000-memory.dmp

      Filesize

      10.8MB

    • memory/3924-25-0x00007FF985EB0000-0x00007FF986972000-memory.dmp

      Filesize

      10.8MB

    • memory/3924-117-0x00007FF985EB0000-0x00007FF986972000-memory.dmp

      Filesize

      10.8MB

    • memory/3924-4-0x00007FF985EB3000-0x00007FF985EB5000-memory.dmp

      Filesize

      8KB

    • memory/3924-3-0x00007FF985EB0000-0x00007FF986972000-memory.dmp

      Filesize

      10.8MB

    • memory/3924-2-0x00007FF985EB0000-0x00007FF986972000-memory.dmp

      Filesize

      10.8MB

    • memory/3924-1-0x000002C400000000-0x000002C401000000-memory.dmp

      Filesize

      16.0MB

    • memory/3924-0-0x00007FF985EB3000-0x00007FF985EB5000-memory.dmp

      Filesize

      8KB