upatre | b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
09/05/2021, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd.exe
Size 38KB
Sample210509-a67z9gnwxs
SHA256 b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd
MD5 ab0f93eb0403b083c81a941ce494c11e
SHA1 696914f2bf1f43055e90907ef66d62d95f862793
SHA512 b699bebc49ca82edab41e50a09fa95d02a1bb4c90198a710ae73ef064d80eab5502c382036a04eed635954ed9fb2ebc5c2b5f1493b1f39f87fabbd9d81e5c524
MD5 SHA1 SHA512

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
3436	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 3436	904	b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd.exe	78
PID 904 wrote to memory of 3436	904	b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd.exe	78
PID 904 wrote to memory of 3436	904	b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd.exe	78

C:\Users\Admin\AppData\Local\Temp\b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd.exe
"C:\Users\Admin\AppData\Local\Temp\b00a289023a36bfc512f39fb1d05c2fb702e7c56ad496ee234dda1285cab0abd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-114-0x0000000000410000-0x00000000004BE000-memory.dmp

Download

memory/3436-118-0x00000000001E0000-0x00000000001E1000-memory.dmp