meduza | ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sigmanly_ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f.exe
Size

2.6MB
MD5

119891f3f60e7bba10a6b60731a8d211
SHA1

576db62811bd9aa8c735b90851b8f872bf223248
SHA256

ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f
SHA512

694f22d1c9f351e8d3d31d33c04cdb403afaf1afb45df65150298d8707c9228c05b8e5b2f7245c48dcf06270eed8dae79a51b23c9cc20470ee860e2584cec4bf
SSDEEP

24576:V9L8hJZ4uB+Ch0lhSMXl72x+GsNompILTDyWD5Q:PL8hD4aurpompILTDyz

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

193.3.19.151

Attributes

anti_dbg
true
anti_vm
true
build_name
hellres
extensions
.txt; .doc; .xlsx
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3192-1-0x000001A202C10000-0x000001A202D51000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Sigmanly_ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	Sigmanly_ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f.exe
Token: SeImpersonatePrivilege	3192	Sigmanly_ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f.exe

C:\Users\Admin\AppData\Local\Temp\Sigmanly_ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f.exe
"C:\Users\Admin\AppData\Local\Temp\Sigmanly_ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3192-0-0x00007FFAE0C90000-0x00007FFAE0E85000-memory.dmp

Filesize
2.0MB

Download
memory/3192-1-0x000001A202C10000-0x000001A202D51000-memory.dmp

Filesize
1.3MB

Download