upatre | 3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19

Analysis

max time kernel
151s
max time network
101s
platform
windows10_x64
resource
win10v20210408
submitted
09/05/2021, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe
Size 30KB
Sample210509-c351dph2pe
SHA256 3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19
MD5 e7412fbd2a0809d22a08caefb982dc1c
SHA1 1ed6bbdd2f2487aff5dfaac2ed82d19621018c4a
SHA512 b59750b413651759b60fd91eef6cd6a83a36e9fb053033d5ce0ec19b237a0c02d887b0d6e3be5616642b16ba8106d7fc07d38d0496da59d702d5fefddfbaee6c
MD5 SHA1 SHA512

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2184	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2184	1032	3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe	77
PID 1032 wrote to memory of 2184	1032	3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe	77
PID 1032 wrote to memory of 2184	1032	3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe	77

C:\Users\Admin\AppData\Local\Temp\3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe
"C:\Users\Admin\AppData\Local\Temp\3b74f9386a3733e782c3c1451cba710af21497bdcb0e49073d6e8bd7d4b3ed19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-114-0x0000000000570000-0x0000000000571000-memory.dmp

Download

memory/2184-118-0x00000000004F0000-0x000000000063A000-memory.dmp