Analysis
-
max time kernel
151s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 12:51
Static task
static1
Behavioral task
behavioral1
Sample
dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe
Resource
win10v20210410
General
-
Target
dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe
-
Size
37KB
-
MD5
cc5c88fa08f78645b7c477c8816fa47e
-
SHA1
e17359cdcde3d266137c685db604dbd9410f6ca9
-
SHA256
dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88
-
SHA512
4bd152218cb3d70fea46080b006c1d75bd45d55eb811d991c382ff99df1340649de9cd7bcacbf84732f6f81ab8024a1127a1270905ab118a81a2be6fe4ad6607
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 1528 szgfw.exe -
Loads dropped DLL 2 IoCs
Processes:
dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exepid process 788 dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe 788 dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exedescription pid process target process PID 788 wrote to memory of 1528 788 dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe szgfw.exe PID 788 wrote to memory of 1528 788 dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe szgfw.exe PID 788 wrote to memory of 1528 788 dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe szgfw.exe PID 788 wrote to memory of 1528 788 dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe"C:\Users\Admin\AppData\Local\Temp\dab7968169cf3106b7252b1272bc39a0403e1649def56d9c60bbc440c89f9c88.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:1528
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e65ac4bdd740b1288c96a9b97e551c35
SHA1b3478e3c012adb81c9784e1c87a6fa4f370d296f
SHA2565138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5
SHA5128c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2
-
MD5
e65ac4bdd740b1288c96a9b97e551c35
SHA1b3478e3c012adb81c9784e1c87a6fa4f370d296f
SHA2565138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5
SHA5128c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2
-
MD5
e65ac4bdd740b1288c96a9b97e551c35
SHA1b3478e3c012adb81c9784e1c87a6fa4f370d296f
SHA2565138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5
SHA5128c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2
-
MD5
e65ac4bdd740b1288c96a9b97e551c35
SHA1b3478e3c012adb81c9784e1c87a6fa4f370d296f
SHA2565138b058a56169d153144e15ac44e197d4a69151df35706b958d7d1bc1e2a5d5
SHA5128c8f99962c417cacbe0f29ca8130e0f4c991eddc4e8531884d496543ba040164f63d3c15143a97458909b451a45b86192d8ee4a20e26bae6f6ebe2678b2560e2