Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
General
-
Target
2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe
-
Size
1.8MB
-
MD5
a000e58ed7523cc210dcc9ff538c1c1c
-
SHA1
03dafef07b08b3d2a87722639b80591ebc29cf92
-
SHA256
2f530fd818f587f0d3158d40bd1908380f8efa2e51463d24414000c580b3d0e2
-
SHA512
dfae2a60c88c37a4b11ec2ceb34457a43d178f227f6249c795ce509a6eeec78afcb431c0ef271e03c8d44dfcb3bce3f8b2e6c7b902e5115b2da4e7e765a53252
-
SSDEEP
24576:ywkdIl1quH1UN7J+3Wi985USl3m5GDci2ftD20kvA6cX6ZbGKS5xFWpGt9u7:AjukYt8uac9UPA6499
Malware Config
Extracted
meduza
127.0.0.1
-
anti_dbg
true
-
anti_vm
true
-
build_name
Meduza
-
extensions
.txt; .doc; .xlsx
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza Stealer payload 7 IoCs
resource yara_rule behavioral1/memory/2568-5-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2568-10-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2568-11-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2568-9-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2568-6-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2568-4-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/2568-3-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2236 set thread context of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2568 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe Token: SeImpersonatePrivilege 2568 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31 PID 2236 wrote to memory of 2568 2236 2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-26_a000e58ed7523cc210dcc9ff538c1c1c_cobalt-strike_ryuk.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2568
-