Edit tour

Windows Analysis Report
Metamask_setup.exe

Overview

General Information

Sample name:	Metamask_setup.exe
Analysis ID:	1379472
MD5:	618f137baf526f754d3ee3885acb9c04
SHA1:	a7f29acee8f33eee1b569fc992bdbbe2f413042c
SHA256:	512ec746b8318aa67bb11aa498a94d0e9848c241e7296c46757dcf1997e28be4
Infos:

Detection

Meduza Stealer

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Meduza Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

Metamask_setup.exe (PID: 7064 cmdline: C:\Users\user\Desktop\Metamask_setup.exe MD5: 618F137BAF526F754D3EE3885ACB9C04)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "77.105.147.171:15666"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Metamask_setup.exe PID: 7064	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Metamask_setup.exe

Avira: detected

Found malware configuration

Source: Metamask_setup.exe

Malware Configuration Extractor: Meduza Stealer {"C2 url": "77.105.147.171:15666"}

Multi AV Scanner detection for submitted file

Source: Metamask_setup.exe	ReversingLabs: Detection: 81%
Source: Metamask_setup.exe	Virustotal: Detection: 79%			Perma Link

Machine Learning detection for sample

Source: Metamask_setup.exe

Joe Sandbox ML: detected

Source: Metamask_setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D308C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF6DF0D308C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D2FDC FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,		0_2_00007FF6DF0D2FDC

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 77.105.147.171:15666

Source: Joe Sandbox View

ASN Name: PLUSTELECOM-ASRU PLUSTELECOM-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF0896F0 std::_Lockit::_Lockit,std::_Lockit::_Lockit,std::_Facet_Register,Concurrency::cancel_current_task,Concurrency::cancel_current_task,_invalid_parameter_noinfo_noreturn,InternetOpenW,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF6DF0896F0

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF09F110 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6DF09F110

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF075F00	0_2_00007FF6DF075F00
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B0874	0_2_00007FF6DF0B0874
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A8090	0_2_00007FF6DF0A8090
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BD488	0_2_00007FF6DF0BD488
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D308C	0_2_00007FF6DF0D308C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0510E0	0_2_00007FF6DF0510E0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B6110	0_2_00007FF6DF0B6110
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AB510	0_2_00007FF6DF0AB510
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B036C	0_2_00007FF6DF0B036C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D4F90	0_2_00007FF6DF0D4F90
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF080790	0_2_00007FF6DF080790
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AF7A0	0_2_00007FF6DF0AF7A0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A83A0	0_2_00007FF6DF0A83A0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BBF9C	0_2_00007FF6DF0BBF9C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0C7830	0_2_00007FF6DF0C7830
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF091A80	0_2_00007FF6DF091A80
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A3680	0_2_00007FF6DF0A3680
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF075AD0	0_2_00007FF6DF075AD0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0896F0	0_2_00007FF6DF0896F0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D6EF4	0_2_00007FF6DF0D6EF4
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BBB08	0_2_00007FF6DF0BBB08
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B8D50	0_2_00007FF6DF0B8D50
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AD590	0_2_00007FF6DF0AD590
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A7180	0_2_00007FF6DF0A7180
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D69A8	0_2_00007FF6DF0D69A8
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AF9A4	0_2_00007FF6DF0AF9A4
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AF59C	0_2_00007FF6DF0AF59C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0959C0	0_2_00007FF6DF0959C0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BB200	0_2_00007FF6DF0BB200
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BC61C	0_2_00007FF6DF0BC61C

Source: classification engine

Classification label: mal80.troj.spyw.winEXE@1/0@0/1

Source: Metamask_setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Metamask_setup.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Metamask_setup.exe	ReversingLabs: Detection: 81%
Source: Metamask_setup.exe	Virustotal: Detection: 79%

Source: Metamask_setup.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Metamask_setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Metamask_setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Metamask_setup.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Metamask_setup.exe

API coverage: 2.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D308C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF6DF0D308C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D2FDC FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,		0_2_00007FF6DF0D2FDC

Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD5A5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF0AE280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6DF0AE280

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0CCE58 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6DF0CCE58
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AE280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF6DF0AE280

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6DF0C70C0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: GetLocaleInfoW,	0_2_00007FF6DF0BA4DC
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6DF0B9F9C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF6DF0C6678
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6DF0C6AA4
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF6DF0C6EDC
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6DF0C69D4

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF0CD3CC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6DF0CD3CC

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: Metamask_setup.exe PID: 7064, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty (Web)
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: Metamask_setup.exe PID: 7064, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Metamask_setup.exe	82%	ReversingLabs	Win64.Spyware.Medusastealer
Metamask_setup.exe	79%	Virustotal		Browse
Metamask_setup.exe	100%	Avira	TR/Spy.Agent.kgbyf
Metamask_setup.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.105.147.171	unknown	Russian Federation		42031	PLUSTELECOM-ASRU	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1379472
Start date and time:	2024-01-23 13:24:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Metamask_setup.exe
Detection:	MAL
Classification:	mal80.troj.spyw.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSTELECOM-ASRU	http://jerryposter.com	Get hash	malicious	Unknown	Browse	77.105.140.181
	hostcr.exe	Get hash	malicious	Remcos	Browse	77.105.132.70
	file.exe	Get hash	malicious	PrivateLoader	Browse	77.105.147.130
	p1vNyPdVh2.exe	Get hash	malicious	Stealc, Vidar, zgRAT	Browse	77.105.132.229
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	0442.EXE.exe	Get hash	malicious	Quasar	Browse	77.105.132.124
	gbquas.exe	Get hash	malicious	Quasar	Browse	77.105.132.124
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.338845189889762
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Metamask_setup.exe
File size:	790'016 bytes
MD5:	618f137baf526f754d3ee3885acb9c04
SHA1:	a7f29acee8f33eee1b569fc992bdbbe2f413042c
SHA256:	512ec746b8318aa67bb11aa498a94d0e9848c241e7296c46757dcf1997e28be4
SHA512:	41d93eb646043fc2a16c0cb123d724db9091109dfd4ed457f45444859a38f463b3b410188d9ec1c0df8a3037a7846e8c94bd8e0dbe29634d44f01feb8a4bdf1e
SSDEEP:	12288:k/Dduefh+bErggggggggMfAF3m5mz1U/uuUtw/8DvC5mukp:mDduz6ggggggggMYF3Imzy2NAaC5M
TLSH:	1EF40934E69C3669D06BA078FC4B5C02E93278AA1320BFEB12D55A511F97EE15F3D360
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q.o.q.o.q.o.:.h.p.o.:.i.p.o.d.j...o.d.k.~.o.d.l.y.o.:.j...o.:.l.v.o.:.k.c.o.q.n...o.:.n.j.o.G.f.}.o.G...p.o.G.m.p.o.Richq.o

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14007cb70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64F15F28 [Fri Sep 1 03:48:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	59fc3561b97c1724a66e573b2805c788

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F397938B398h
dec eax
add esp, 28h
jmp 00007F397938A9BFh
int3
int3
and dword ptr [0003DBE5h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [0001C68Ah]
test eax, eax
je 00007F397938AB46h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007F397938AB09h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007F397938C484h
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [0001C62Dh]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [0001C61Bh]
dec eax
test eax, eax
je 00007F397938AB7Eh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [0001C5E2h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5b90	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc6000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xbd000	0x79e0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc7000	0xb54	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa76a0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa7700	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa7560	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x99000	0x650	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x97edc	0x98000	14fecd9441573d8f8846ade337580ead	False	0.42626953125	zlib compressed data	6.304920226712859	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x99000	0x1e0c0	0x1e200	2619a9f8e04fbdc4bbf68a1be1ba22e6	False	0.4567313926348548	DIY-Thermocam raw data (Lepton 2.x), scale 25856-27648, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 154742504910672534362390528.000000, slope 2543115696954447765978707132416.000000	5.510471051944646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb8000	0x4484	0x1e00	1ac5d7acfbfbd5b995f739e66ca25ec4	False	0.16067708333333333	data	3.2862763790147604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xbd000	0x79e0	0x7a00	9063aa876dbea603cc0cba3a374e398d	False	0.40320824795081966	data	5.843380934302045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0xc5000	0x15c	0x200	392099a42f1a81299705ff2d92da8379	False	0.41015625	data	3.3726519446433953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc6000	0x1e0	0x200	40051623f806a9ed9f88c3948606ca62	False	0.52734375	data	4.7137725829467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc7000	0xb54	0xc00	b58ee936f6aedd3f50b5062d1561ba30	False	0.4661458333333333	data	5.269667204999112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc6060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	htons, inet_pton, WSAStartup, send, socket, connect, recv, WSACleanup, closesocket
CRYPT32.dll	CryptUnprotectData
WININET.dll	InternetQueryDataAvailable, InternetReadFile, InternetCloseHandle, InternetOpenW, InternetOpenUrlA, InternetOpenA, HttpQueryInfoW
ntdll.dll	NtQueryObject, NtQuerySystemInformation
RstrtMgr.DLL	RmGetList, RmStartSession, RmEndSession, RmRegisterResources
KERNEL32.dll	MultiByteToWideChar, LocalFree, WideCharToMultiByte, IsDebuggerPresent, WriteProcessMemory, TerminateProcess, GetModuleFileNameW, WaitForSingleObject, ResumeThread, CloseHandle, GetThreadContext, VirtualAllocEx, CreateProcessW, SetThreadContext, GetExitCodeProcess, ExitProcess, ReadFile, GetModuleFileNameA, GetVolumeInformationW, GetGeoInfoA, HeapFree, EnterCriticalSection, GetCurrentProcess, GetProcessId, GetProductInfo, LeaveCriticalSection, SetFilePointer, InitializeCriticalSectionEx, GetModuleHandleA, OpenProcess, HeapSize, GetLogicalDriveStringsW, GetFinalPathNameByHandleA, GetTimeZoneInformation, GetLastError, HeapReAlloc, GetNativeSystemInfo, HeapAlloc, GetUserGeoID, DecodePointer, GetProcAddress, GetFileSize, DeleteCriticalSection, GetComputerNameW, GetProcessHeap, GlobalMemoryStatusEx, GetModuleHandleW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, IsProcessorFeaturePresent, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeLibrary, GetModuleHandleExW, VirtualAlloc, VirtualProtect, VirtualQuery, GetCurrentThreadId, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, SetStdHandle, CreateFileW, WriteConsoleW, OutputDebugStringW, SetEndOfFile, FreeEnvironmentStringsW, SetEnvironmentVariableW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LCMapStringEx, GetCommandLineA, GetCommandLineW, GetSystemInfo, GetEnvironmentStringsW, GetFileInformationByHandleEx, AreFileApisANSI, GetFileAttributesExW, FindNextFileW, FindFirstFileExW, FindFirstFileW, FindClose, FormatMessageA, GetLocaleInfoEx, GetCurrentDirectoryW
USER32.dll	EnumDisplayDevicesW, GetDC, GetSystemMetrics, GetWindowRect, ReleaseDC, GetDesktopWindow
GDI32.dll	BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetDeviceCaps, DeleteDC, GetObjectW, DeleteObject
ADVAPI32.dll	RegCloseKey, RegQueryValueExA, RegOpenKeyExA, GetUserNameW, RegEnumKeyExA, GetCurrentHwProfileW
SHELL32.dll	ShellExecuteA, SHGetKnownFolderPath
ole32.dll	CoTaskMemFree, CreateStreamOnHGlobal
SHLWAPI.dll
gdiplus.dll	GdiplusStartup, GdiplusShutdown, GdipGetImageEncoders, GdipCloneImage, GdipAlloc, GdipCreateBitmapFromScan0, GdipSaveImageToStream, GdipGetImageEncodersSize, GdipDisposeImage, GdipFree, GdipCreateBitmapFromHBITMAP

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 23, 2024 13:24:59.873930931 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:00.086932898 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:00.588654995 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:00.802571058 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:01.307445049 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:01.520523071 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:02.026153088 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:02.239245892 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:02.744898081 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:02.958246946 CET	15666	49729	77.105.147.171	192.168.2.4

Target ID:	0
Start time:	13:24:59
Start date:	23/01/2024
Path:	C:\Users\user\Desktop\Metamask_setup.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Metamask_setup.exe
Imagebase:	0x7ff6df050000
File size:	790'016 bytes
MD5 hash:	618F137BAF526F754D3EE3885ACB9C04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	10

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Metamask_setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Metamask_setup.exePID: 7064, Parent PID: 2580

General

Chronological Activities

Disassembly

Windows Analysis Report
Metamask_setup.exe