0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 04:04

Target

0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe
Size

103KB
MD5

aeb3e644d0aaefb954cf5262b69dec10
SHA1

c89dd83ea8bd91766aa68dff476c15c151789e08
SHA256

0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd
SHA512

376e9cc6baba28d276deab3b5077c0fdd1a2a12b6afd6283a73fd04eae565e93cd91a63f22ad1b050f6a5799b72254d30cc81226bb54c7eb6fa31bbdee9b3135
SSDEEP

1536:iLYI5cv54f5HPrUbs9+S8SoJX1LN7WWNhtiUtUXqEsFyqyPo5NldRM:htQ9+IoJX1LN7Lvt1UBsS

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2828	murzuja.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2828	2196	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	28
PID 2196 wrote to memory of 2828	2196	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	28
PID 2196 wrote to memory of 2828	2196	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	28
PID 2196 wrote to memory of 2828	2196	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	28

C:\Users\Admin\AppData\Local\Temp\0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe
"C:\Users\Admin\AppData\Local\Temp\0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:2828

\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
103KB

MD5
de7fc9027ff1adc616fd3b7012eb90e9

SHA1
3c1df7159842f439595bfa0f7d594ce1c82693b9

SHA256
13241c8f24ea754d1bab3e8a06d921d7dd0bd806f80a8cf1baf5bc27f12df98e

SHA512
bea31771969fd6c1ba39a4c446e13e5bc20fd4143649f6f24a7ed3ae717fa94040b1e539ef2be6f579138b00e9b15549a0c395044c5416d7e4003247f9c5c29e

Download Submit
memory/2196-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2196-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2828-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download