04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 17:45

Target
04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c.exe
Size 40KB
Sample240310-wbrrlshc72
SHA256 04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c
MD5 d415720d59ff46ac8adc7377db3ebad0
SHA1 e720fdd26bd411c95bd57fb4a6764b1d3fa8d059
SHA512 dc53cd7f8d620239a84d0c547cd0d4034ab174fae2d2f6a11babddff22029f66bb3b6e5f864f4307f6f8430df5783a9e9463162cbf7d03161f9a0524f6720a0b
SSDEEP 768:oUV9xDcXiosEGyzvO/KllFYYnhd4PLa0yuFhW2g+I:o89xAXiosN6UKllFYYnhd4PLa0DFhng9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
892	vusjeson.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 892	116	04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c.exe	95
PID 116 wrote to memory of 892	116	04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c.exe	95
PID 116 wrote to memory of 892	116	04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c.exe	95

C:\Users\Admin\AppData\Local\Temp\04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c.exe
"C:\Users\Admin\AppData\Local\Temp\04a010708340e7132a7e475ebff0f923308487010ed59c0c309ed29cde97c81c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  2⤵
  - Executes dropped EXE
  PID:892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4108

vusjeson.exe

Path C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
Size 40KB
SHA256 14865d947a01d41a9323b5b12fffdb53cdb8c4b6c2770dd0110a6efaefc12206
MD5 a092b6105fcf144fd2f5c8a5e67a2711
SHA1 42d802b1e153d7a9ca364e1437c633adfe4b4561
SHA512 5d52e5d69aad7a8cd78af0ee452cbfea7d2a81d125b334fb3f0646d03420e6ac38d8f001f1515d027cc52ff608c736562c73fae41541099f60395581ff12372e
SSDEEP 768:oUV9xDcXiosEGyzvO/KllFYYnhd4PLa0yuFhW2g+D:o89xAXiosN6UKllFYYnhd4PLa0DFhngK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/892-5-0x0000000000400000-0x000000000040D000-memory.dmp

Download