meduza | 3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/01/2025, 04:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe
Size

2.6MB
MD5

a45a9d7f9d4fc7eafd45f10eae62ad88
SHA1

6955187b25889fc75d42a0a84af97c6e071eb7cb
SHA256

3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c
SHA512

c9858c03cb5166e12b513df7cd328a25b27bbb039cea295077f0b0cc01789c8e591ec0e63c42c56994d4f18bf8690fe3f1db55d21440af820a8b6414b14b0ab2
SSDEEP

24576:V9L8hJZ4uB+Ch0lhSMXlNnx1BLuAeQcYgHHd4pcT15Q:PL8hD4au93BLuXQtgn2f

Score

10^/10

meduza stealer

Malware Config

Extracted

Family

meduza

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
SEO2.0
extensions
.txt; .doc; .xlsx
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/3020-0-0x0000000001DA0000-0x0000000001EE1000-memory.dmp	family_meduza
behavioral1/memory/3020-1-0x0000000001DA0000-0x0000000001EE1000-memory.dmp	family_meduza

Meduza family
meduza

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation	3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe
Token: SeImpersonatePrivilege	3020	3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe

C:\Users\Admin\AppData\Local\Temp\3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe
"C:\Users\Admin\AppData\Local\Temp\3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3020

Network

No results found

45.130.145.152:15666

3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe

152 B
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000001DA0000-0x0000000001EE1000-memory.dmp

Filesize
1.3MB

Download
memory/3020-1-0x0000000001DA0000-0x0000000001EE1000-memory.dmp

Filesize
1.3MB

Download