upatre | 80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c

Analysis

max time kernel
150s
max time network
105s
platform
windows7_x64
resource
win7v20210410
submitted
08/05/2021, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe
Size

9KB
MD5

02f9fdbad10a5915c4320ca783d2740b
SHA1

ce32da4ca17e5c5352bbee031349a0556942aa25
SHA256

80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c
SHA512

d761a3fcef68d07cda86b9be0986f0f511b17bb870013a805271606de04e4b64e7be4830acc272bb324ab7d471ff6b07e3c8719545a9e71957f7de98146ccff9

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1500	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1084	80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe
1084	80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1500	1084	80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe	17
PID 1084 wrote to memory of 1500	1084	80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe	17
PID 1084 wrote to memory of 1500	1084	80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe	17
PID 1084 wrote to memory of 1500	1084	80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe	17

C:\Users\Admin\AppData\Local\Temp\80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe
"C:\Users\Admin\AppData\Local\Temp\80a9acf19f576c8449e29840b61d757cb5615e9b9cece45609e37c57f7fa182c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-60-0x00000000752F1000-0x00000000752F3000-memory.dmp

Filesize
8KB

Download