a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:13

Target

a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe
Size

67KB
MD5

ad41b1788fac93c03099a155e7ce9933
SHA1

5b42f53d7c6e6b71f27828ffde56d3110ebcba5a
SHA256

a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab
SHA512

1b77f4e9c30e5d38464f3d0f3369375e57fb400898e01c8d6785c806124a0168e26dec6981b422469f3d85271b95c15429bb96dc4e115ce30eb73ddcb10f7ce9
SSDEEP

1536:9dIERu8ic9Zd8Z3PstS+GccqxGXuqNlqDWhq4eUj9Ww6:9dVS+1xGXuqNl6Wh2UMw6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4644	murzuja.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4644	4068	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	97
PID 4068 wrote to memory of 4644	4068	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	97
PID 4068 wrote to memory of 4644	4068	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	97

C:\Users\Admin\AppData\Local\Temp\a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe
"C:\Users\Admin\AppData\Local\Temp\a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
67KB

MD5
c0817dfe3428aabf1664aaeb0c918572

SHA1
4b5f8fdca1593f86bf9993f17b0e5d40836949e0

SHA256
b2908afe5543904ac8c20ceee0900f2e5ab4f038a9034921b16e7ea47cd4d2ed

SHA512
77eda4ca3e650b998f56ecbd3849bae20527bdee14063ecee34fb988cc6ea9dd2a038186c657012865f2cd29d9bd9abcd51384d4748b6624a459d39b9579c44f

Download Submit
memory/4068-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4068-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4644-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download