upatre | 63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3

Analysis

max time kernel
151s
max time network
11s
platform
windows7_x64
resource
win7v20210408
submitted
04-05-2021 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe
Size

38KB
MD5

c8ba29d219c276418aecbd9d17a80157
SHA1

225ad2488ee9a1edace490dc87a1356b4fbc953f
SHA256

63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3
SHA512

3460190e87565a558bbb3d7fa2e121c2cf89383d5f31d36edf1e287bde018f157c6614f8c9f352c01d4216d9efef07e55f6f481001f4a15fa0c0fe8e3a1cd088

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1508	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1612	63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe
1612	63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1508	1612	63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe	29
PID 1612 wrote to memory of 1508	1612	63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe	29
PID 1612 wrote to memory of 1508	1612	63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe	29
PID 1612 wrote to memory of 1508	1612	63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe	29

C:\Users\Admin\AppData\Local\Temp\63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe
"C:\Users\Admin\AppData\Local\Temp\63e4d6e3d352a16e9a2ae7e107eb50fbfe846ba629cf95925dac6975d06b9fe3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-60-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1612-61-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download