Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/07/2023, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
Resource
win10v2004-20230703-en
General
-
Target
7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
-
Size
106KB
-
MD5
e98d012c23668413c276433e3792644e
-
SHA1
ae09cf2a6df73ca5a6d7d5452ff1e4778fa4edf1
-
SHA256
7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c
-
SHA512
446203c707f275ccc205767fe0914b9aaf1606322f75f3023d5f531728fc2ce1ba4dd8520308772bbeba08b1a8a3600a5a63b1749b428c3e4ee59227d8c5bd72
-
SSDEEP
1536:5OYV9aUjJucIQgu1vPIWE+b2SoJX1LNdAWNjtDTGUnqrsw1jQ+hS:8URE+VoJX1LNdVVtOU6sp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2600 murzuja.exe -
Loads dropped DLL 1 IoCs
pid Process 2060 7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 icanhazip.com -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2600 2060 7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe 28 PID 2060 wrote to memory of 2600 2060 7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe 28 PID 2060 wrote to memory of 2600 2060 7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe 28 PID 2060 wrote to memory of 2600 2060 7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe"C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\murzuja.exeC:\Users\Admin\AppData\Local\Temp\murzuja.exe2⤵
- Executes dropped EXE
PID:2600
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5cf4e2b5cad2dd066cada338b42f3e539
SHA1f96f826600170d35e77139392ee9f88553eb4f65
SHA2564db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c
SHA5123335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3
-
Filesize
106KB
MD5cf4e2b5cad2dd066cada338b42f3e539
SHA1f96f826600170d35e77139392ee9f88553eb4f65
SHA2564db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c
SHA5123335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3
-
Filesize
106KB
MD5cf4e2b5cad2dd066cada338b42f3e539
SHA1f96f826600170d35e77139392ee9f88553eb4f65
SHA2564db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c
SHA5123335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3