Edit tour

Windows Analysis Report
ZIOpctBE0o.exe

Overview

General Information

Sample name:	ZIOpctBE0o.exe renamed because original name is a hash value
Original sample name:	de4ed476df7cdbcd737dbd4a8db764cd7d0bca1e6e09748e424645c8a21607d7.exe
Analysis ID:	1617317
MD5:	06ff127c1db7dd45b7e368d8f4ba48e4
SHA1:	b11dcbd6d3e9e33046b6f2e1698c595d4a566c67
SHA256:	de4ed476df7cdbcd737dbd4a8db764cd7d0bca1e6e09748e424645c8a21607d7
Tags:	exeWHKzW2nruser-JAMESWT_MHT
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ZIOpctBE0o.exe (PID: 4712 cmdline: "C:\Users\user\Desktop\ZIOpctBE0o.exe" MD5: 06FF127C1DB7DD45B7E368D8F4BA48E4)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "SEO2.0", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.2061379181.0000020AAE5D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x114944:$str01: emoji 0x1175d8:$str02: %d-%m-%Y, %H:%M:%S 0x117648:$str03: [UTC 0x117650:$str04: user_name 0x117698:$str05: computer_name 0x117670:$str06: timezone 0x1175a8:$str07: current_path() 0x114908:$str08: [json.exception. 0x12f42c:$str09: GDI32.dll 0x12f69e:$str10: GdipGetImageEncoders 0x12f716:$str10: GdipGetImageEncoders 0x12ecb0:$str11: GetGeoInfoA
Process Memory Space: ZIOpctBE0o.exe PID: 4712	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: ZIOpctBE0o.exe PID: 4712	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ZIOpctBE0o.exe.20aae1c0000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.ZIOpctBE0o.exe.20aae1c0000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x114944:$str01: emoji 0x1175d8:$str02: %d-%m-%Y, %H:%M:%S 0x117648:$str03: [UTC 0x117650:$str04: user_name 0x117698:$str05: computer_name 0x117670:$str06: timezone 0x1175a8:$str07: current_path() 0x114908:$str08: [json.exception. 0x12f42c:$str09: GDI32.dll 0x12f69e:$str10: GdipGetImageEncoders 0x12f716:$str10: GdipGetImageEncoders 0x12ecb0:$str11: GetGeoInfoA
0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x113144:$str01: emoji 0x115dd8:$str02: %d-%m-%Y, %H:%M:%S 0x115e48:$str03: [UTC 0x115e50:$str04: user_name 0x115e98:$str05: computer_name 0x115e70:$str06: timezone 0x115da8:$str07: current_path() 0x113108:$str08: [json.exception. 0x12dc2c:$str09: GDI32.dll 0x12de9e:$str10: GdipGetImageEncoders 0x12df16:$str10: GdipGetImageEncoders 0x12d4b0:$str11: GetGeoInfoA

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T18:30:13.148487+0100	2049441	1	A Network Trojan was detected	192.168.2.5	49704	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "SEO2.0", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: ZIOpctBE0o.exe	ReversingLabs: Detection: 75%
Source: ZIOpctBE0o.exe	Virustotal: Detection: 72%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE237BA0 CryptUnprotectData,LocalFree,	0_2_0000020AAE237BA0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE238020 BCryptDecrypt,BCryptDecrypt,	0_2_0000020AAE238020
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE237EC0 CryptProtectData,LocalFree,	0_2_0000020AAE237EC0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F7C20 CryptUnprotectData,LocalFree,	0_2_0000020AAE1F7C20
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F3A30 BCryptDestroyKey,	0_2_0000020AAE1F3A30
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2383C0 BCryptCloseAlgorithmProvider,	0_2_0000020AAE2383C0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE238440 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,Concurrency::cancel_current_task,	0_2_0000020AAE238440

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: ZIOpctBE0o.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE27B500 FindClose,FindFirstFileExW,GetLastError,	0_2_0000020AAE27B500
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE27B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_0000020AAE27B5B0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE295100 FindFirstFileW,	0_2_0000020AAE295100

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE2473F0 GetLogicalDriveStringsW,

0_2_0000020AAE2473F0

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.5:49704 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE244A30 recv,recv,closesocket,WSACleanup,

0_2_0000020AAE244A30

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC70C000.00000004.00000020.00020000.00000000.sdmp, ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: https://api.ipify.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE245B70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_0000020AAE245B70

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE249D30 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_0000020AAE249D30
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2956F8 NtQuerySystemInformation,	0_2_0000020AAE2956F8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE24A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_0000020AAE24A430

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE209F80	0_2_0000020AAE209F80
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE248030	0_2_0000020AAE248030
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE23F020	0_2_0000020AAE23F020
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE22D080	0_2_0000020AAE22D080
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE24D050	0_2_0000020AAE24D050
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F20B0	0_2_0000020AAE1F20B0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1EFE20	0_2_0000020AAE1EFE20
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE262E3C	0_2_0000020AAE262E3C
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE245B70	0_2_0000020AAE245B70
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F4B70	0_2_0000020AAE1F4B70
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F1B90	0_2_0000020AAE1F1B90
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1FECB0	0_2_0000020AAE1FECB0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F2CA0	0_2_0000020AAE1F2CA0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE225970	0_2_0000020AAE225970
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1FCA10	0_2_0000020AAE1FCA10
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1EF730	0_2_0000020AAE1EF730
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE246860	0_2_0000020AAE246860
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1FD570	0_2_0000020AAE1FD570
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE27B5B0	0_2_0000020AAE27B5B0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE24C5CB	0_2_0000020AAE24C5CB
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1FE610	0_2_0000020AAE1FE610
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE280658	0_2_0000020AAE280658
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2476A0	0_2_0000020AAE2476A0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE205310	0_2_0000020AAE205310
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE226350	0_2_0000020AAE226350
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F0450	0_2_0000020AAE1F0450
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2120F6	0_2_0000020AAE2120F6
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE25918C	0_2_0000020AAE25918C
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE245240	0_2_0000020AAE245240
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE235EF0	0_2_0000020AAE235EF0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1FBF40	0_2_0000020AAE1FBF40
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE27FFBC	0_2_0000020AAE27FFBC
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2630B8	0_2_0000020AAE2630B8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE217CEB	0_2_0000020AAE217CEB
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE234D40	0_2_0000020AAE234D40
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE250D14	0_2_0000020AAE250D14
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE258D50	0_2_0000020AAE258D50
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1C5DB0	0_2_0000020AAE1C5DB0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1FADD0	0_2_0000020AAE1FADD0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE21BDD0	0_2_0000020AAE21BDD0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F0E80	0_2_0000020AAE1F0E80
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F7E70	0_2_0000020AAE1F7E70
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE240E90	0_2_0000020AAE240E90
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE211AF0	0_2_0000020AAE211AF0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE238B00	0_2_0000020AAE238B00
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE26BB90	0_2_0000020AAE26BB90
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F98CD	0_2_0000020AAE1F98CD
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE23C8E0	0_2_0000020AAE23C8E0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE25A924	0_2_0000020AAE25A924
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F3A30	0_2_0000020AAE1F3A30
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1F0A80	0_2_0000020AAE1F0A80
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE266A68	0_2_0000020AAE266A68
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE235AB0	0_2_0000020AAE235AB0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE21BAB0	0_2_0000020AAE21BAB0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE220AC0	0_2_0000020AAE220AC0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2646E4	0_2_0000020AAE2646E4
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE214720	0_2_0000020AAE214720
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE24A780	0_2_0000020AAE24A780
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE21B780	0_2_0000020AAE21B780
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE222750	0_2_0000020AAE222750
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE25579C	0_2_0000020AAE25579C
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE25F7E6	0_2_0000020AAE25F7E6
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2614E4	0_2_0000020AAE2614E4
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1E5520	0_2_0000020AAE1E5520
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE246540	0_2_0000020AAE246540
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1E6510	0_2_0000020AAE1E6510
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE255598	0_2_0000020AAE255598
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1C6610	0_2_0000020AAE1C6610
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE25666C	0_2_0000020AAE25666C
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE268674	0_2_0000020AAE268674
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2636A8	0_2_0000020AAE2636A8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE23E2F0	0_2_0000020AAE23E2F0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE26A3C8	0_2_0000020AAE26A3C8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE255394	0_2_0000020AAE255394
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2363A6	0_2_0000020AAE2363A6
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1E83D0	0_2_0000020AAE1E83D0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE24A430	0_2_0000020AAE24A430
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE21C420	0_2_0000020AAE21C420
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE23B420	0_2_0000020AAE23B420
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE21B480	0_2_0000020AAE21B480
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE26A44F	0_2_0000020AAE26A44F
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE21C0F0	0_2_0000020AAE21C0F0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1C70E0	0_2_0000020AAE1C70E0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE25F0D8	0_2_0000020AAE25F0D8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE26C128	0_2_0000020AAE26C128
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE253150	0_2_0000020AAE253150
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE1C6180	0_2_0000020AAE1C6180
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE256164	0_2_0000020AAE256164
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2671D8	0_2_0000020AAE2671D8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE251220	0_2_0000020AAE251220
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2302C0	0_2_0000020AAE2302C0

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: String function: 0000020AAE1F6940 appears 41 times
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: String function: 0000020AAE1EE1D0 appears 33 times
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: String function: 0000020AAE2086B0 appears 57 times
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: String function: 0000020AAE258254 appears 34 times
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: String function: 0000020AAE1EBA80 appears 32 times

Source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE24B9B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

0_2_0000020AAE24B9B0

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE1FE610 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0000020AAE1FE610

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE234ED0 CoCreateInstance,

0_2_0000020AAE234ED0

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69637645C654

Source: ZIOpctBE0o.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZIOpctBE0o.exe	ReversingLabs: Detection: 75%
Source: ZIOpctBE0o.exe	Virustotal: Detection: 72%

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ZIOpctBE0o.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ZIOpctBE0o.exe

Static file information: File size 2749952 > 1048576

Source: ZIOpctBE0o.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x24bc00

Source: ZIOpctBE0o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ZIOpctBE0o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ZIOpctBE0o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ZIOpctBE0o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ZIOpctBE0o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ZIOpctBE0o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ZIOpctBE0o.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ZIOpctBE0o.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: ZIOpctBE0o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ZIOpctBE0o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ZIOpctBE0o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ZIOpctBE0o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ZIOpctBE0o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE1FD570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0000020AAE1FD570

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE20CAB2 push rdi; retf 0004h

0_2_0000020AAE20CAB5

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE23C600 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_0000020AAE23C600

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE27B500 FindClose,FindFirstFileExW,GetLastError,	0_2_0000020AAE27B500
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE27B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_0000020AAE27B5B0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE295100 FindFirstFileW,	0_2_0000020AAE295100

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE2473F0 GetLogicalDriveStringsW,

0_2_0000020AAE2473F0

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE259038 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_0000020AAE259038

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	API call chain: ExitProcess graph end node			graph_0-68922
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	API call chain: ExitProcess graph end node			graph_0-68927

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE295708 LdrEnumerateLoadedModules,

0_2_0000020AAE295708

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE257F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0000020AAE257F68

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE27D804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_0000020AAE27D804

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE1FD570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0000020AAE1FD570

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE269EEC GetProcessHeap,

0_2_0000020AAE269EEC

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE257F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000020AAE257F68
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE2952E0 SetUnhandledExceptionFilter,	0_2_0000020AAE2952E0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE26F498 SetUnhandledExceptionFilter,	0_2_0000020AAE26F498
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: 0_2_0000020AAE26F2B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000020AAE26F2B8

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE23B420 ShellExecuteW,

0_2_0000020AAE23B420

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE26DF10 cpuid

0_2_0000020AAE26DF10

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: EnumSystemLocalesW,	0_2_0000020AAE268F60
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: EnumSystemLocalesW,	0_2_0000020AAE269030
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoW,	0_2_0000020AAE25E020
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0000020AAE2690C8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: EnumSystemLocalesW,	0_2_0000020AAE25DAE0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0000020AAE268C04
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoW,	0_2_0000020AAE269518
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0000020AAE26964C
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoW,	0_2_0000020AAE269310
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: EnumSystemLocalesW,	0_2_0000020AAE2953B8
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoW,EnumSystemLocalesW,RaiseException,	0_2_0000020AAE2953A0
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0000020AAE269468
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_0000020AAE27B170

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE26F908 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000020AAE26F908

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE246150 GetUserNameW,

0_2_0000020AAE246150

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Code function: 0_2_0000020AAE262E3C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_0000020AAE262E3C

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: ZIOpctBE0o.exe PID: 4712, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061379181.0000020AAE5D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZIOpctBE0o.exe PID: 4712, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: ZIOpctBE0o.exe, 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\ZIOpctBE0o.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ZIOpctBE0o.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: ZIOpctBE0o.exe PID: 4712, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ZIOpctBE0o.exe.20aae1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061379181.0000020AAE5D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZIOpctBE0o.exe PID: 4712, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZIOpctBE0o.exe	75%	ReversingLabs	Win64.Trojan.MeduzaStealer
ZIOpctBE0o.exe	72%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617317
Start date and time:	2025-02-17 18:29:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZIOpctBE0o.exe renamed because original name is a hash value
Original Sample Name:	de4ed476df7cdbcd737dbd4a8db764cd7d0bca1e6e09748e424645c8a21607d7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 81 Number of non-executed functions: 123
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.130.145.152	pablo.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	billys.exe	Get hash	malicious	Meduza Stealer	Browse
	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	venomderek.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=xml
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	copia_01929pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Doc 1189623388009.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	play.wav.htm	Get hash	malicious	HtmlDropper	Browse	104.26.12.205
	CheckList Job no.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://nodeissuesfix.com/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://business.secure-accounts-security.com/wp-content/.htaccess	Get hash	malicious	Unknown	Browse	104.26.12.205
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	NexoPack Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	2HgZnWGWPe.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	7n8jjIFn5M.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	8vNAzcRheC.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	45.93.200.175
	Setup.exe	Get hash	malicious	Unknown	Browse	45.93.201.181
	1738842483c13df414985ff28eae0e6b09c3d0db7cc5eaeac1623278a4d4c0c8da56993060344.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	45.135.232.38
	1738649104be845ad7a6cb80f192f5e9eddca83a4d6a7977b7f05d925d9569b5cf1e82cd77936.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	45.135.232.38
	weChateams (3).exe	Get hash	malicious	Unknown	Browse	212.192.14.53
	weChateams (3).exe	Get hash	malicious	Unknown	Browse	212.192.14.53
	t7ezlyhxpf56ojs26xk697l0i4zl1bt.exe	Get hash	malicious	I2PRAT	Browse	193.53.127.246
	https://telegrabmm.com/	Get hash	malicious	Unknown	Browse	193.53.126.69
	173715408512e4c3c85b256a83c3a15cc3e6edc1cf7794155c2d2fa3159fed8c9b52869327859.dat-decoded.exe	Get hash	malicious	Quasar	Browse	45.135.232.38
	173715408790e0671373b3dba7df5e0d1c20631f6645499b625784ca27993d6059e2485bda426.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
CLOUDFLARENETUS	https://rpqffvhbb.cc.rs6.net/tn.jsp?f=0014kcclQXjPXojT0ti9V52RcXl4z4Vz--beWhEpNrqnLWHxys4qF9LPuo_spJkGtd99wCHXIF8SrjNw5f7C7a4uHYln_cY2bKtw_9grTGpKhyUdMN54rd5jGq9iXvjTQ_1ZqPOlcyaJO5i6eVirYCS-Aw8Yj3ZjuVLOe5I_meMvRPB2ZFMGWUJnIhs01nCTgS6IU1DHYOHg0cPeTM9oCls9zcwREma1URiZR_mcbieP3coMGuF7tAZZKkqIGQi3B0QOls2fxlpqFxzOMHmfXgLkQ==&c=m9vJ9fSAy80r925LymjLMH-zd09aiPFcNFYgM-NaI83_5TV5j31yRA==&ch=metbn8RrmYKdxQqAH_UNs4zoTXwjYFbMJ4QbLNi8NvHcFYJaLDgOEA==	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	https://adfs-OZrtY7DQglHoAZotD0jKGmDz9af367vOzfOaftUDQT6I4YZH3E.lumpnk.ru/vXsP8/###9jbuxkemper@louisianaspine.org	Get hash	malicious	Unknown	Browse	104.16.2.189
	https://www.buildwithbrick.com/	Get hash	malicious	Anonymous Proxy	Browse	104.17.25.14
	https://na4.docusign.net/Signing/EmailStart.aspx?a=3c56b97e-f52b-41fb-a108-03e6f0b98497&etti=24&acct=64ac2e03-602c-40bb-a404-aa2fbcd4cb57&er=c83d01c5-2226-4002-b236-f161c9bed457	Get hash	malicious	HTMLPhisher	Browse	104.18.87.42
	mMS2hfsyJd.img	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	2025 Q1 Staff Pay Adjustment-Handbook.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	poll.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.172.121
	SecuriteInfo.com.Win64.Trojan.Agent.SPKBLR.21082.13583.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	cool.exe	Get hash	malicious	Discord Rat	Browse	162.159.134.234
	cool.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	RFQ_SRC02252017-pdf.scr.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	RFQ_SRC02252017-pdf.scr.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	Nonmerchantable.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Payment_Swift Copy_ TXR077901844095342_pdf.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	172.67.74.152
	updater.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	Request for Quotation TX00171164_pdf.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	JUSTIF. PAGO AQUISGRANpdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Hermaean.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	facturar.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	3.912212893179806
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZIOpctBE0o.exe
File size:	2'749'952 bytes
MD5:	06ff127c1db7dd45b7e368d8f4ba48e4
SHA1:	b11dcbd6d3e9e33046b6f2e1698c595d4a566c67
SHA256:	de4ed476df7cdbcd737dbd4a8db764cd7d0bca1e6e09748e424645c8a21607d7
SHA512:	5378ffb98c7a1cfa9c74ceb3f2f016f48e96dcce9444cb5d8b84f5f070741e06a5e040225386c7f55e3025d2d39513bd682519f42c4c223b0c3655d79a1d901a
SSDEEP:	24576:V9L8hJZ4uB+Ch0lhSMXlXCtNCvyoPyRxsVTcu6WjZEt2WVNW9+y5Q:PL8hD4aunCuxyRxsVT36WeVg+
TLSH:	23D5F196B7E404F8E1BB8238C8D60A46E773785603519BCF03A486B62F276D35E3E751
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\7...V...V...V.......V.......V.......V......yV..S....V..S....V..S....V.. ....V..P...<V..S....V...V...V..S....V..S.a..V..S....V.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14003e230
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6762C4F4 [Wed Dec 18 12:49:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	259e8414ffd4b8ab603913db518e276c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD6E8B3573Ch
dec eax
add esp, 28h
jmp 00007FD6E8B34BAFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FD6E8B34D42h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FD6E8B34D45h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FD6E8B34D3Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FD6E8B34776h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000FE37h]
dec eax
mov ecx, ebx
call dword ptr [0000FE26h]
call dword ptr [0000FD90h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0000FE1Ch]
dec eax
mov dword ptr [esp+00h], ecx

Rich Headers

Programming Language:

[IMP] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x298c04	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a3000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x29e000	0x4038	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a4000	0xad0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x290d80	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x290c40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e000	0x438	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4cdc0	0x4ce00	f0c0ea36bf296498c8b89c1a1671ba6c	False	0.5267625762195122	data	6.539312086987541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4e000	0x24ba3a	0x24bc00	50de05a449d226c717f3fec2f44e509e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29a000	0x330c	0x1800	d1ebd331d3cf6c8adbb31602bd239ee4	False	0.1865234375	data	3.2382802275840623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x29e000	0x4038	0x4200	8411825e2467307cedb8b6c4f15d3cdf	False	0.47123579545454547	data	5.575992239724539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2a3000	0x1e0	0x200	fd7f3c77b3b8152760b71a549e0deae5	False	0.52734375	data	4.7113407225994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a4000	0xad0	0xc00	49c311309af6d41eb0a329b47e6c6fcc	False	0.4716796875	data	5.228340394510781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2a3060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	FreeEnvironmentStringsW, GetEnvironmentStringsW, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, FlushInstructionCache, VirtualQuery, WriteProcessMemory, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, GetModuleHandleA, MultiByteToWideChar, GetWindowsDirectoryW, ExitProcess, WideCharToMultiByte, GetLastError, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, CreateThread, ExitThread, FreeLibrary, FreeLibraryAndExitThread, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetCurrentThreadId, DeleteCriticalSection, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, HeapSize, GetProcessHeap, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, GetFileSizeEx, SetFilePointerEx, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, WriteConsoleW, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, WakeAllConditionVariable, QueryPerformanceCounter, LCMapStringEx, DecodePointer, InitializeCriticalSectionEx, GetFileInformationByHandleEx, FormatMessageA, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, Sleep, WaitForSingleObjectEx, GetExitCodeThread, LocalFree, GetLocaleInfoEx, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, AreFileApisANSI
USER32.dll	LoadAcceleratorsW, LoadAcceleratorsA
ADVAPI32.dll	GetTokenInformation, OpenProcessToken
OLEAUT32.dll	SysAllocString, SafeArrayPutElement, SafeArrayUnaccessData, SafeArrayCreate, SafeArrayCreateVector, SafeArrayAccessData, SysFreeString, SafeArrayDestroy
mscoree.dll	CLRCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-17T18:30:13.148487+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.5	49704	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 18:30:10.528496027 CET	49704	15666	192.168.2.5	45.130.145.152
Feb 17, 2025 18:30:10.533396959 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:10.533485889 CET	49704	15666	192.168.2.5	45.130.145.152
Feb 17, 2025 18:30:10.605797052 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:10.605829954 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:10.605928898 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:10.610047102 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:10.610063076 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.126189947 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.126384974 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.177779913 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.177792072 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.178112030 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.178174973 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.179188967 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.219342947 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.293956995 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.294008970 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:11.294040918 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.294068098 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.294377089 CET	49705	443	192.168.2.5	172.67.74.152
Feb 17, 2025 18:30:11.294392109 CET	443	49705	172.67.74.152	192.168.2.5
Feb 17, 2025 18:30:12.294346094 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:12.294400930 CET	49704	15666	192.168.2.5	45.130.145.152
Feb 17, 2025 18:30:13.148487091 CET	49704	15666	192.168.2.5	45.130.145.152
Feb 17, 2025 18:30:13.153568029 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153578043 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153646946 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153655052 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153719902 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153728008 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153804064 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153812885 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153822899 CET	15666	49704	45.130.145.152	192.168.2.5
Feb 17, 2025 18:30:13.153840065 CET	15666	49704	45.130.145.152	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 18:30:10.593039036 CET	58370	53	192.168.2.5	1.1.1.1
Feb 17, 2025 18:30:10.600085974 CET	53	58370	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 17, 2025 18:30:10.593039036 CET	192.168.2.5	1.1.1.1	0xd0e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 17, 2025 18:30:10.600085974 CET	1.1.1.1	192.168.2.5	0xd0e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Feb 17, 2025 18:30:10.600085974 CET	1.1.1.1	192.168.2.5	0xd0e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Feb 17, 2025 18:30:10.600085974 CET	1.1.1.1	192.168.2.5	0xd0e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.74.152	443	4712	C:\Users\user\Desktop\ZIOpctBE0o.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-17 17:30:11 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-02-17 17:30:11 UTC	424	IN	HTTP/1.1 200 OK Date: Mon, 17 Feb 2025 17:30:11 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 913780fc3e678c65-EWR server-timing: cfL4;desc="?proto=TCP&rtt=3030&min_rtt=3030&rtt_var=1515&sent=6&recv=8&lost=0&retrans=1&sent_bytes=4178&recv_bytes=738&delivery_rate=167354&cwnd=209&unsent_bytes=0&cid=c527213b0cac8a0f&ts=192&x=0"
2025-02-17 17:30:11 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	12:30:09
Start date:	17/02/2025
Path:	C:\Users\user\Desktop\ZIOpctBE0o.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ZIOpctBE0o.exe"
Imagebase:	0x7ff6cfe50000
File size:	2'749'952 bytes
MD5 hash:	06FF127C1DB7DD45B7E368D8F4BA48E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2060727680.0000020AAC68C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2061379181.0000020AAE5D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000000.00000002.2061153206.0000020AAE1C0000.00000040.00001000.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZIOpctBE0o.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
ZIOpctBE0o.exe