262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0

General

Target

262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe
Size

52.5MB
MD5

c9d598317a092e5c199544be6b3800ce
SHA1

0d1cb3659420e75c1312031ac7475c70b19af3a9
SHA256

262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0
SHA512

cfd757095fcb47a6b4d289ce8f012e6565499bd204fb22473131fd7b386af4e508f577b4ab6f1f3624701509a3e79ea67d9345950ea1326c1d514d7efd8be00d
SSDEEP

786432:Dypsj8x7vWWYvnnT05vYZWOoxLDDB3H697dJg6SnfdcxNwbxOI6sQ2Z0vupW:qsjSWWinTwvZxf93H697Q6s8NXFt2qwW

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
872	irsetup.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000012319-55.dat	upx
behavioral1/files/0x000a000000012319-58.dat	upx
behavioral1/files/0x000a000000012319-57.dat	upx
behavioral1/files/0x000a000000012319-56.dat	upx
behavioral1/files/0x000a000000012319-60.dat	upx
behavioral1/files/0x000a000000012319-62.dat	upx
behavioral1/memory/872-65-0x0000000000400000-0x0000000000581000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe
1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe
1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe
1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
872	irsetup.exe
872	irsetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28
PID 1172 wrote to memory of 872	1172	262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe	28

C:\Users\Admin\AppData\Local\Temp\262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe
"C:\Users\Admin\AppData\Local\Temp\262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\262b042ba9157b6b7e1cd60e8c1719ffde20fdca7669122c0b9d741b7c3cd1c0.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-3845472200-3839195424-595303356-1000"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
566KB

MD5
3fe7c92dba5c9240b4ab0d6a87e6166a

SHA1
7980d7dffc073515b621834246dda33ab00c308d

SHA256
a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

SHA512
bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
566KB

MD5
3fe7c92dba5c9240b4ab0d6a87e6166a

SHA1
7980d7dffc073515b621834246dda33ab00c308d

SHA256
a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

SHA512
bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
566KB

MD5
3fe7c92dba5c9240b4ab0d6a87e6166a

SHA1
7980d7dffc073515b621834246dda33ab00c308d

SHA256
a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

SHA512
bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
566KB

MD5
3fe7c92dba5c9240b4ab0d6a87e6166a

SHA1
7980d7dffc073515b621834246dda33ab00c308d

SHA256
a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

SHA512
bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
566KB

MD5
3fe7c92dba5c9240b4ab0d6a87e6166a

SHA1
7980d7dffc073515b621834246dda33ab00c308d

SHA256
a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

SHA512
bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
566KB

MD5
3fe7c92dba5c9240b4ab0d6a87e6166a

SHA1
7980d7dffc073515b621834246dda33ab00c308d

SHA256
a7818c1e0dad1cbba4d17809688887adeeafe940a3cb53a6aeabdfcd196f7258

SHA512
bd2c87b2d02b80b90f744a101bbb9294b1d90650a338be725028e6649e46a759fa72032e80ffe911ae82b005b4d2394960e7b73ce7ad8fe3a70e8a47d2a7c98d

Download Submit
memory/872-65-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1172-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1172-63-0x00000000028A0000-0x0000000002A21000-memory.dmp

Filesize
1.5MB

Download
memory/1172-64-0x00000000028A0000-0x0000000002A21000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing