c45f3d6e119324a0381903df0d3ad7feafee9affba8f0dc3e2263183e376c313

General

Target

19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe
Size

89.5MB
MD5

29b65192dded2499cbfa4da86fff8d63
SHA1

504d4e3a028dfa8b25ace7f7e65e8e50762e2a94
SHA256

19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878
SHA512

2e857feef8d67cf5e724f11dd8bbb5d71e8e0d7b6bbb97bfe3390a69a8ec26252489642cb917a97d7476ecad39ea22392fc8374cbf91ae8ed2d7db63a2581d0c
SSDEEP

1572864:GVTlgywHTuSQBem/SSde6JUgdjlROqNnVyizOAkR5TwoDTTwoD5:YTlgBT1jzSLjTOMR6YoDQoD5

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe

Executes dropped EXE 1 IoCs

pid	Process
2100	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	irsetup.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022dfa-5.dat	upx
behavioral2/files/0x0006000000022dfa-10.dat	upx
behavioral2/files/0x0006000000022dfa-11.dat	upx
behavioral2/memory/2100-14-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/2100-43-0x0000000000400000-0x00000000007CB000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Setup_SoftPlot9_Log.txt	irsetup.exe
File opened for modification	C:\Windows\Setup_SoftPlot9_Log.txt	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2100	irsetup.exe
2100	irsetup.exe
2100	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2100	4756	19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe	89
PID 4756 wrote to memory of 2100	4756	19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe	89
PID 4756 wrote to memory of 2100	4756	19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe	89

C:\Users\Admin\AppData\Local\Temp\19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe
"C:\Users\Admin\AppData\Local\Temp\19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-177160434-2093019976-369403398-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\SoftPlot10Icon.ico

Filesize
52KB

MD5
265c5203f435725d63273321e03d77a7

SHA1
d56f8561cbce42fb74ba008c799c1266932d3140

SHA256
9c4d55555640f2e317ff9f062d79f2f642ea9b17244376e2d921b6f2933c4d3c

SHA512
5fb820a25f39edabee24907570ed4e2f6f8a239d3f3747ff87397e5e1421f36737adaeba3f06778c671606ad1231e68838ad613a3f792708372552c4c454f153

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
memory/2100-14-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2100-43-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing