meduza | 75acf95197b3097e37fd11e0d48eefb85d814eaff36ad60d9a20ee7df8d76c50

General

Target

2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe
Size

3.1MB
MD5

9c0b4a4fe825b04e1f5bf35bd5b73b8f
SHA1

63929ea5284d01e9bbb735870dcb5525b1389128
SHA256

75acf95197b3097e37fd11e0d48eefb85d814eaff36ad60d9a20ee7df8d76c50
SHA512

0c1e6437ee3afa71ef51cd290ff7ce4c2eddec6dc2cc99567daefb5f8dd5c1d91ee75c3101317d8fc2376d85986ef61e5cab52a6675b92e9c07c53cf11670f2e
SSDEEP

24576:qiixlR6I3vbasXpLtwBOz9qhjDWsoQ4lFEHLEBINGIJkoqIUrKybKffn3kiIGHI8:UxVRsw6NxAI0jG

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
SEO2.0
extensions
.txt; .doc; .xlsx
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 7 IoCs

resource	yara_rule
behavioral1/memory/2076-8-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2076-10-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2076-11-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2076-5-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2076-4-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2076-3-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2076-6-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\International\Geo\Nation	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe
Token: SeImpersonatePrivilege	2076	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28
PID 2412 wrote to memory of 2076	2412	2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-01-05_9c0b4a4fe825b04e1f5bf35bd5b73b8f_cobalt-strike_ryuk.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-8-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-10-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-11-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-7-0x000007FFFFFDC000-0x000007FFFFFDD000-memory.dmp

Filesize
4KB

Download
memory/2076-5-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-4-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-3-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-6-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-2-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2076-1-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing