47c57530b5b6de027182a6e4fed09bdae9e57cebc090fb52ce948d72e75ca663

General

Target
1FD2310B128E99EEFE9ACFCC8C221A35.exe
Size 1.7MB
Sample210617-zhadyddata
SHA256 47c57530b5b6de027182a6e4fed09bdae9e57cebc090fb52ce948d72e75ca663
MD5 1fd2310b128e99eefe9acfcc8c221a35
SHA1 7af05c0be338e496552947081ad025f0e12039a5
SHA512 9b5f9bc74a40ce45e032a7ddb1bfa7e6b5e2c5553281ff09d8e15aa09d4351d22a9a89059886ed2faf40e73fd227bc9f591bccc27f7c404f4940816f9bc1142f
MD5 SHA1 SHA512

Score

8^/10

upx

Executes dropped EXE 3 IoCs

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Loads dropped DLL 2 IoCs

pid	Process
3280	irsetup.exe
2156	irsetup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 10 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3280	640	1FD2310B128E99EEFE9ACFCC8C221A35.exe	75
PID 640 wrote to memory of 3280	640	1FD2310B128E99EEFE9ACFCC8C221A35.exe	75
PID 640 wrote to memory of 3280	640	1FD2310B128E99EEFE9ACFCC8C221A35.exe	75
PID 3280 wrote to memory of 3252	3280	irsetup.exe	80
PID 3280 wrote to memory of 3252	3280	irsetup.exe	80
PID 3280 wrote to memory of 3252	3280	irsetup.exe	80
PID 3252 wrote to memory of 2156	3252	SetupB_343.exe	81
PID 3252 wrote to memory of 2156	3252	SetupB_343.exe	81
PID 3252 wrote to memory of 2156	3252	SetupB_343.exe	81

C:\Users\Admin\AppData\Local\Temp\1FD2310B128E99EEFE9ACFCC8C221A35.exe
"C:\Users\Admin\AppData\Local\Temp\1FD2310B128E99EEFE9ACFCC8C221A35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1790210 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\1FD2310B128E99EEFE9ACFCC8C221A35.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1594587808-2047097707-2163810515-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Users\Admin\AppData\Local\Temp\SetupB_343.exe
    C:\Users\Admin\AppData\Local\Temp\SetupB_343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" __IRAOFF:1796642 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\SetupB_343.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1594587808-2047097707-2163810515-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2156