Overview

overview

10

Static

static

3

2025-02-07...uk.exe

windows7-x64

10

2025-02-07...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-02-2025 23:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-07_566ba3327696259d85d67a11b59ce380_cobalt-strike_ryuk.exe

  • Size

    3.1MB

  • MD5

    566ba3327696259d85d67a11b59ce380

  • SHA1

    93d30a7208307eec594b60b9909aa0c095eea6f5

  • SHA256

    7e862d24eb0a3d7b1c5eec79d69be0b4269700c2cf4b5b868ea9c02b6fa6b6b5

  • SHA512

    bbc4ba6ce993b89dead9e287670de574da29f9890ef688ffe12a91896232b6adeab693aa86fc79717d0c304093ec007a67492be23c2ded65f04118b0c080222e

  • SSDEEP

    24576:Tiil7t613rOauk7EUbBCcn3dCjgrxmPxOGcvQ2EodKGPavD9eKKbEHQFDizxajRT:/F4Z3oZITQEPkc7viIVP

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

meduza

C2

147.45.44.216

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    961

  • grabber_max_size

    1.048576e+06

  • port

    15666

  • self_destruct

    true

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza
  • Meduza Stealer payload 5 IoCs
  • Meduza family
    meduza
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-07_566ba3327696259d85d67a11b59ce380_cobalt-strike_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-07_566ba3327696259d85d67a11b59ce380_cobalt-strike_ryuk.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Users\Admin\AppData\Local\Temp\2025-02-07_566ba3327696259d85d67a11b59ce380_cobalt-strike_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-02-07_566ba3327696259d85d67a11b59ce380_cobalt-strike_ryuk.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1824
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTIzNTdENzQtQjdERC00RDA3LTlDNzEtMzBBQjYxRkZBQjZDfSIgdXNlcmlkPSJ7MTM2MjNCMDYtM0M4Ni00MEY1LThDMTMtMTFCOEU0QzdBM0FFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTAxQUYxMkUtNTA4RS00RjY1LUIwMkYtNjA4Mjc4ODEzRTBEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDAwNDQ2NjEwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1824-2-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1824-1-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1824-3-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1824-0-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1824-12-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB

    Download