Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2023, 05:47

General

  • Target

    7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe

  • Size

    106KB

  • MD5

    e98d012c23668413c276433e3792644e

  • SHA1

    ae09cf2a6df73ca5a6d7d5452ff1e4778fa4edf1

  • SHA256

    7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c

  • SHA512

    446203c707f275ccc205767fe0914b9aaf1606322f75f3023d5f531728fc2ce1ba4dd8520308772bbeba08b1a8a3600a5a63b1749b428c3e4ee59227d8c5bd72

  • SSDEEP

    1536:5OYV9aUjJucIQgu1vPIWE+b2SoJX1LNdAWNjtDTGUnqrsw1jQ+hS:8URE+VoJX1LNdVVtOU6sp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
    "C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:988
    • C:\Users\Admin\AppData\Local\Temp\murzuja.exe
      C:\Users\Admin\AppData\Local\Temp\murzuja.exe
      2⤵
      • Executes dropped EXE
      PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\murzuja.exe

    Filesize

    106KB

    MD5

    cf4e2b5cad2dd066cada338b42f3e539

    SHA1

    f96f826600170d35e77139392ee9f88553eb4f65

    SHA256

    4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

    SHA512

    3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

  • C:\Users\Admin\AppData\Local\Temp\murzuja.exe

    Filesize

    106KB

    MD5

    cf4e2b5cad2dd066cada338b42f3e539

    SHA1

    f96f826600170d35e77139392ee9f88553eb4f65

    SHA256

    4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

    SHA512

    3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

  • memory/988-133-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/988-137-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/5084-139-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB