meduza | 2f530fd818f587f0d3158d40bd1908380f8efa2e51463d24414000c580b3d0e2

General

Target

2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe
Size

1.8MB
MD5

a000e58ed7523cc210dcc9ff538c1c1c
SHA1

03dafef07b08b3d2a87722639b80591ebc29cf92
SHA256

2f530fd818f587f0d3158d40bd1908380f8efa2e51463d24414000c580b3d0e2
SHA512

dfae2a60c88c37a4b11ec2ceb34457a43d178f227f6249c795ce509a6eeec78afcb431c0ef271e03c8d44dfcb3bce3f8b2e6c7b902e5115b2da4e7e765a53252
SSDEEP

24576:ywkdIl1quH1UN7J+3Wi985USl3m5GDci2ftD20kvA6cX6ZbGKS5xFWpGt9u7:AjukYt8uac9UPA6499

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

127.0.0.1

Attributes

anti_dbg
true
anti_vm
true
build_name
Meduza
extensions
.txt; .doc; .xlsx
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 7 IoCs

resource	yara_rule
behavioral1/memory/2568-5-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2568-10-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2568-11-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2568-9-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2568-6-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2568-4-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2568-3-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe
Token: SeImpersonatePrivilege	2568	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31
PID 2236 wrote to memory of 2568	2236	2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-7-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

Filesize
4KB

Download
memory/2568-5-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-10-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-11-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-9-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-6-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-4-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-3-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-2-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2568-1-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing