7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 05:47

Target

7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
Size

106KB
MD5

e98d012c23668413c276433e3792644e
SHA1

ae09cf2a6df73ca5a6d7d5452ff1e4778fa4edf1
SHA256

7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c
SHA512

446203c707f275ccc205767fe0914b9aaf1606322f75f3023d5f531728fc2ce1ba4dd8520308772bbeba08b1a8a3600a5a63b1749b428c3e4ee59227d8c5bd72
SSDEEP

1536:5OYV9aUjJucIQgu1vPIWE+b2SoJX1LNdAWNjtDTGUnqrsw1jQ+hS:8URE+VoJX1LNdVVtOU6sp

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2600	murzuja.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2600	2060	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	28
PID 2060 wrote to memory of 2600	2060	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	28
PID 2060 wrote to memory of 2600	2060	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	28
PID 2060 wrote to memory of 2600	2060	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	28

C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
"C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:2600

C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
106KB

MD5
cf4e2b5cad2dd066cada338b42f3e539

SHA1
f96f826600170d35e77139392ee9f88553eb4f65

SHA256
4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

SHA512
3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
106KB

MD5
cf4e2b5cad2dd066cada338b42f3e539

SHA1
f96f826600170d35e77139392ee9f88553eb4f65

SHA256
4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

SHA512
3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

Download Submit
\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
106KB

MD5
cf4e2b5cad2dd066cada338b42f3e539

SHA1
f96f826600170d35e77139392ee9f88553eb4f65

SHA256
4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

SHA512
3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

Download Submit
memory/2060-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2600-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download