meduza | 83807d120841b596969c1743a9fa1836a2ce5fea941f3a627e0dabd7878ce479

Analysis

max time kernel
91s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

executorInstaller.exe
Size

36.0MB
MD5

19a3a6307f17a18ec4a00e00d015372f
SHA1

8a05bc9961583710fd6ac7846e782385c79e07da
SHA256

83807d120841b596969c1743a9fa1836a2ce5fea941f3a627e0dabd7878ce479
SHA512

64e388c1e4c4a175a22e9f52d8cef797933f76830c6c20819b970d1c67c87ee9a5e960278dd1e1bb58fb35e784d3c0dc5d42623e778d6002a07eeac22ea3502f
SSDEEP

196608:EdyKwYFXGdPUD1cdEeok12Tx0B8P8Dd2RJ:YNGCeok1cPdr

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Work
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3620-8-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral2/memory/3620-9-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral2/memory/3620-6-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral2/memory/3620-10-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe

Executes dropped EXE 2 IoCs

pid	Process
3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe
3620	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3892 set thread context of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe
Token: SeImpersonatePrivilege	3620	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3892	2860	executorInstaller.exe	99
PID 2860 wrote to memory of 3892	2860	executorInstaller.exe	99
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100
PID 3892 wrote to memory of 3620	3892	28c3acdc-5b48-4ec0-b033-cf54078b4148.exe	100

C:\Users\Admin\AppData\Local\Temp\executorInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\executorInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\bf72944e-2d36-4d0e-bf76-adf62dcdd2c4\28c3acdc-5b48-4ec0-b033-cf54078b4148.exe
  "C:\Users\Admin\AppData\Local\Temp\bf72944e-2d36-4d0e-bf76-adf62dcdd2c4\28c3acdc-5b48-4ec0-b033-cf54078b4148.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Users\Admin\AppData\Local\Temp\bf72944e-2d36-4d0e-bf76-adf62dcdd2c4\28c3acdc-5b48-4ec0-b033-cf54078b4148.exe
    "C:\Users\Admin\AppData\Local\Temp\bf72944e-2d36-4d0e-bf76-adf62dcdd2c4\28c3acdc-5b48-4ec0-b033-cf54078b4148.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bf72944e-2d36-4d0e-bf76-adf62dcdd2c4\28c3acdc-5b48-4ec0-b033-cf54078b4148.exe

Filesize
3.1MB

MD5
bec59ef4a85d4996622a0cad150f752c

SHA1
4414781aed2bad425cad3d36e3748f3e3d211747

SHA256
60e66e1f5f94ae12b02e0198be4b70ec2b2abaa0e98df8d74f9583c8764fdca9

SHA512
9bc032eef38daf863cb3425aeb2901d80c8cca269f3b47c2466338568e6ed22764b8230d391921c9de6df9dcd33fd35b87201fd73f35e200c70cfcec9a67d643

Download Submit
memory/3620-8-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/3620-9-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/3620-6-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/3620-10-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download