0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd

Analysis

max time kernel
145s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 04:04

Target

0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe
Size

103KB
MD5

aeb3e644d0aaefb954cf5262b69dec10
SHA1

c89dd83ea8bd91766aa68dff476c15c151789e08
SHA256

0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd
SHA512

376e9cc6baba28d276deab3b5077c0fdd1a2a12b6afd6283a73fd04eae565e93cd91a63f22ad1b050f6a5799b72254d30cc81226bb54c7eb6fa31bbdee9b3135
SSDEEP

1536:iLYI5cv54f5HPrUbs9+S8SoJX1LN7WWNhtiUtUXqEsFyqyPo5NldRM:htQ9+IoJX1LN7Lvt1UBsS

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4564	murzuja.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4564	1268	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	100
PID 1268 wrote to memory of 4564	1268	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	100
PID 1268 wrote to memory of 4564	1268	0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe	100

C:\Users\Admin\AppData\Local\Temp\0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe
"C:\Users\Admin\AppData\Local\Temp\0390875ccc9dc5025484604f968c050c24615732c25fbef6d4fb31955e6cf2bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4944

C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
103KB

MD5
de7fc9027ff1adc616fd3b7012eb90e9

SHA1
3c1df7159842f439595bfa0f7d594ce1c82693b9

SHA256
13241c8f24ea754d1bab3e8a06d921d7dd0bd806f80a8cf1baf5bc27f12df98e

SHA512
bea31771969fd6c1ba39a4c446e13e5bc20fd4143649f6f24a7ed3ae717fa94040b1e539ef2be6f579138b00e9b15549a0c395044c5416d7e4003247f9c5c29e

Download Submit
memory/1268-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1268-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4564-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download