meduza | 83807d120841b596969c1743a9fa1836a2ce5fea941f3a627e0dabd7878ce479

General

Target

executorInstaller.exe
Size

36.0MB
MD5

19a3a6307f17a18ec4a00e00d015372f
SHA1

8a05bc9961583710fd6ac7846e782385c79e07da
SHA256

83807d120841b596969c1743a9fa1836a2ce5fea941f3a627e0dabd7878ce479
SHA512

64e388c1e4c4a175a22e9f52d8cef797933f76830c6c20819b970d1c67c87ee9a5e960278dd1e1bb58fb35e784d3c0dc5d42623e778d6002a07eeac22ea3502f
SSDEEP

196608:EdyKwYFXGdPUD1cdEeok12Tx0B8P8Dd2RJ:YNGCeok1cPdr

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Work
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2216-16-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-11-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-20-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-19-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-13-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-14-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-12-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/2216-21-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\International\Geo\Nation	9fe6859d-0438-4b1e-b089-07826b99ff88.exe

Executes dropped EXE 2 IoCs

pid	Process
2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe
2216	9fe6859d-0438-4b1e-b089-07826b99ff88.exe

Loads dropped DLL 2 IoCs

pid	Process
2500	executorInstaller.exe
2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	9fe6859d-0438-4b1e-b089-07826b99ff88.exe
Token: SeImpersonatePrivilege	2216	9fe6859d-0438-4b1e-b089-07826b99ff88.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2236	2500	executorInstaller.exe	32
PID 2500 wrote to memory of 2236	2500	executorInstaller.exe	32
PID 2500 wrote to memory of 2236	2500	executorInstaller.exe	32
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33
PID 2236 wrote to memory of 2216	2236	9fe6859d-0438-4b1e-b089-07826b99ff88.exe	33

C:\Users\Admin\AppData\Local\Temp\executorInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\executorInstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\69e078d6-ac14-4660-8fec-1335df375529\9fe6859d-0438-4b1e-b089-07826b99ff88.exe
  "C:\Users\Admin\AppData\Local\Temp\69e078d6-ac14-4660-8fec-1335df375529\9fe6859d-0438-4b1e-b089-07826b99ff88.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\69e078d6-ac14-4660-8fec-1335df375529\9fe6859d-0438-4b1e-b089-07826b99ff88.exe
    "C:\Users\Admin\AppData\Local\Temp\69e078d6-ac14-4660-8fec-1335df375529\9fe6859d-0438-4b1e-b089-07826b99ff88.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\69e078d6-ac14-4660-8fec-1335df375529\9fe6859d-0438-4b1e-b089-07826b99ff88.exe

Filesize
3.1MB

MD5
bec59ef4a85d4996622a0cad150f752c

SHA1
4414781aed2bad425cad3d36e3748f3e3d211747

SHA256
60e66e1f5f94ae12b02e0198be4b70ec2b2abaa0e98df8d74f9583c8764fdca9

SHA512
9bc032eef38daf863cb3425aeb2901d80c8cca269f3b47c2466338568e6ed22764b8230d391921c9de6df9dcd33fd35b87201fd73f35e200c70cfcec9a67d643

Download Submit
memory/2216-8-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-15-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

Filesize
4KB

Download
memory/2216-16-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-11-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-20-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-19-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-13-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-14-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-12-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-10-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-9-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2216-21-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing