Analysis Overview
SHA256
eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e
Threat Level: Known bad
The file eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e was found to be: Known bad.
Malicious Activity Summary
Upatre
Executes dropped EXE
Loads dropped DLL
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-05-09 22:38
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-05-09 22:38
Reported
2021-05-10 05:53
Platform
win7v20210408
Max time kernel
151s
Max time network
14s
Command Line
Signatures
Upatre
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\szgfw.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 360 wrote to memory of 848 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
| PID 360 wrote to memory of 848 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
| PID 360 wrote to memory of 848 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
| PID 360 wrote to memory of 848 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe
"C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe"
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
Network
Files
memory/360-60-0x0000000075451000-0x0000000075453000-memory.dmp
\Users\Admin\AppData\Local\Temp\szgfw.exe
| MD5 | 38096fb4a12694fd25a1345d37947b54 |
| SHA1 | 1faebacf5bd603fd691059183cd0c476e0391d59 |
| SHA256 | a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5 |
| SHA512 | 28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7 |
\Users\Admin\AppData\Local\Temp\szgfw.exe
| MD5 | 38096fb4a12694fd25a1345d37947b54 |
| SHA1 | 1faebacf5bd603fd691059183cd0c476e0391d59 |
| SHA256 | a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5 |
| SHA512 | 28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7 |
memory/848-63-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
| MD5 | 38096fb4a12694fd25a1345d37947b54 |
| SHA1 | 1faebacf5bd603fd691059183cd0c476e0391d59 |
| SHA256 | a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5 |
| SHA512 | 28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7 |
memory/360-66-0x0000000000220000-0x0000000000221000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
| MD5 | 38096fb4a12694fd25a1345d37947b54 |
| SHA1 | 1faebacf5bd603fd691059183cd0c476e0391d59 |
| SHA256 | a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5 |
| SHA512 | 28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7 |
Analysis: behavioral2
Detonation Overview
Submitted
2021-05-09 22:38
Reported
2021-05-10 05:53
Platform
win10v20210408
Max time kernel
152s
Max time network
138s
Command Line
Signatures
Upatre
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\szgfw.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 856 wrote to memory of 3064 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
| PID 856 wrote to memory of 3064 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
| PID 856 wrote to memory of 3064 | N/A | C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe | C:\Users\Admin\AppData\Local\Temp\szgfw.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe
"C:\Users\Admin\AppData\Local\Temp\eff106657d6db5868729c08737d816c7e63aa954c17831229ba8047a1c1e1c0e.exe"
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
Network
Files
memory/856-114-0x0000000002470000-0x0000000002471000-memory.dmp
memory/3064-115-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
| MD5 | 38096fb4a12694fd25a1345d37947b54 |
| SHA1 | 1faebacf5bd603fd691059183cd0c476e0391d59 |
| SHA256 | a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5 |
| SHA512 | 28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7 |
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
| MD5 | 38096fb4a12694fd25a1345d37947b54 |
| SHA1 | 1faebacf5bd603fd691059183cd0c476e0391d59 |
| SHA256 | a5bc2d13080cf9ee70bcf19a878d4105aaa96ad2068fc38bb5bdb8c3cac643f5 |
| SHA512 | 28c3f1e46f638c495e361a116f6f5e7da5ded1795968577e3dc20c0a31faec0754a9a3002fede3fd0ad7a643e8326faf1788792b21e4304347c29765a245e7e7 |