meduza | 53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d

Analysis

max time kernel
97s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe
Size

14.1MB
MD5

a2db986f46fc915b6b9b65d0d8b2c92f
SHA1

2aca2a24c33ea49c99365438cf4eee6c42fa73ed
SHA256

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d
SHA512

3e7346aba18a18c0e2fcb57baf2822cca67da175c8b7dfd675b1b5cd78092051e7443eac156a954297c16623f9c74cad4347ef015682282bec57fb056435652d
SSDEEP

393216:PXIJM3GodH2ThNzd4VQpier42zXfDmITsttRugNId:fUuozdshA4iXf/iuFd

Score

10^/10

meduza zgrat persistence rat stealer

Malware Config

Extracted

Family

meduza

109.107.181.83

Signatures

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3224-10-0x0000027650090000-0x000002765030E000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-11-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-18-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-20-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-34-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-42-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-66-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-70-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-74-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-72-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-68-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-64-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-62-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-58-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-56-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-54-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-60-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-52-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-50-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-48-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-46-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-44-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-40-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-38-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-36-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-32-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-30-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-28-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-24-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-22-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-26-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-16-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-14-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/3224-12-0x0000027650090000-0x0000027650308000-memory.dmp	family_zgrat_v1
behavioral1/memory/4092-4919-0x0000000009650000-0x0000000009906000-memory.dmp	family_zgrat_v1

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza
Meduza Stealer payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/4900-4902-0x0000000140000000-0x00000001400E9000-memory.dmp family_meduza
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 2 IoCs

Processes:

chalengesophisticated.exechallengesophisticated.exe

pid process

3224 chalengesophisticated.exe
4092 challengesophisticated.exe

resource	yara_rule
behavioral1/memory/4900-4902-0x0000000140000000-0x00000001400E9000-memory.dmp	family_meduza

pid	process
3224	chalengesophisticated.exe
4092	challengesophisticated.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chalengesophisticated.exe

description pid process target process

PID 3224 set thread context of 4900 3224 chalengesophisticated.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3004 powershell.exe
3004 powershell.exe

description	pid	process	target process
PID 3224 set thread context of 4900	3224	chalengesophisticated.exe	InstallUtil.exe

pid	process
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

chalengesophisticated.exepowershell.exechallengesophisticated.exe

description	pid	process
Token: SeDebugPrivilege	3224	chalengesophisticated.exe
Token: SeDebugPrivilege	3224	chalengesophisticated.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	4092	challengesophisticated.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exechalengesophisticated.exe

description	pid	process	target process
PID 2948 wrote to memory of 3224	2948	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	chalengesophisticated.exe
PID 2948 wrote to memory of 3224	2948	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	chalengesophisticated.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 4900	3224	chalengesophisticated.exe	InstallUtil.exe
PID 3224 wrote to memory of 3004	3224	chalengesophisticated.exe	powershell.exe
PID 3224 wrote to memory of 3004	3224	chalengesophisticated.exe	powershell.exe
PID 2948 wrote to memory of 4092	2948	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	challengesophisticated.exe
PID 2948 wrote to memory of 4092	2948	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	challengesophisticated.exe
PID 2948 wrote to memory of 4092	2948	53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe	challengesophisticated.exe

C:\Users\Admin\AppData\Local\Temp\53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe
"C:\Users\Admin\AppData\Local\Temp\53bcea75646e0a3ff08fea4990c0e3458eb5b518bfdd907444485499803ba25d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
3⤵
PID:4900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe' -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chalengesophisticated.exe
Filesize
14.5MB

MD5
66d0f556615ce40c851f1b7347773570

SHA1
5bf87f9716e522cf4f77a03fd7caa3ed94ad7882

SHA256
725e9172a1aafa7d2e4bdf37257df0d67f6c307035f7ad893a0bc5dad58dd199

SHA512
4a67a0173a3073b4b177a2e5d42dc62c8b3a5c159d82c73fa177f439880df14c6e7b7b2d8dec855b3fc0ceb7cb395d85cec40e5d5e31ebe8fa089e0e8282137f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\challengesophisticated.exe
Filesize
16.4MB

MD5
aee8e83de9876ffaf39c78af9e288505

SHA1
5099fa9c38a612ed01b452bbfe36cd7c529deccc

SHA256
94e7120a4b7e58905de44f90abdce85f3ce97669249563ca50680dcecdd5bc7c

SHA512
1019222635fcf1b8477d19177e77dedbdbcac4eecf3bb096dc60204448eca653771fc33fb124bfb79e9bcf5d5de68a4fd61cf18d7dc8cbfc2e538aa4713e5ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zx1bzryv.4cr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3004-4914-0x000001C5E2AB0000-0x000001C5E2AD2000-memory.dmp

Filesize
136KB

Download
memory/3224-7-0x00007FFF7BA00000-0x00007FFF7C4C1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-8-0x0000027634190000-0x0000027635014000-memory.dmp

Filesize
14.5MB

Download
memory/3224-9-0x000002764F510000-0x000002764F520000-memory.dmp

Filesize
64KB

Download
memory/3224-10-0x0000027650090000-0x000002765030E000-memory.dmp

Filesize
2.5MB

Download
memory/3224-11-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-18-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-20-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-34-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-42-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-66-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-70-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-74-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-72-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-68-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-64-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-62-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-58-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-56-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-54-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-60-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-52-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-50-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-48-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-46-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-44-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-40-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-38-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-36-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-32-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-30-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-28-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-24-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-22-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-26-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-16-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-14-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-12-0x0000027650090000-0x0000027650308000-memory.dmp

Filesize
2.5MB

Download
memory/3224-4891-0x0000027636D00000-0x0000027636D01000-memory.dmp

Filesize
4KB

Download
memory/3224-4892-0x000002764F5E0000-0x000002764F69A000-memory.dmp

Filesize
744KB

Download
memory/3224-4893-0x000002764F470000-0x000002764F4BC000-memory.dmp

Filesize
304KB

Download
memory/3224-4894-0x00007FFF7BA00000-0x00007FFF7C4C1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-4895-0x000002764F510000-0x000002764F520000-memory.dmp

Filesize
64KB

Download
memory/3224-4897-0x000002764F4C0000-0x000002764F514000-memory.dmp

Filesize
336KB

Download
memory/3224-4903-0x00007FFF7BA00000-0x00007FFF7C4C1000-memory.dmp

Filesize
10.8MB

Download
memory/4092-4907-0x0000000000B00000-0x0000000001B6C000-memory.dmp

Filesize
16.4MB

Download
memory/4092-4918-0x0000000006370000-0x0000000006402000-memory.dmp

Filesize
584KB

Download
memory/4092-4919-0x0000000009650000-0x0000000009906000-memory.dmp

Filesize
2.7MB

Download
memory/4092-4920-0x0000000009EC0000-0x000000000A464000-memory.dmp

Filesize
5.6MB

Download
memory/4092-9803-0x00000000067D0000-0x00000000068C4000-memory.dmp

Filesize
976KB

Download
memory/4900-4902-0x0000000140000000-0x00000001400E9000-memory.dmp

Filesize
932KB

Download