upatre | 6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e

Analysis

max time kernel
151s
max time network
8s
platform
windows7_x64
resource
win7v20210410
submitted
11-05-2021 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe
Size

37KB
MD5

e771548dd85c36b1e537b8f3b3becec5
SHA1

53570a0f49b441f52d8651db4500fa55b9b3e9ca
SHA256

6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e
SHA512

4d0b67503239f6db34468bfcc7907d963b85f62e08744e7368a19958a8672571380847bf35aef6c4560e43db74cebd13de49c1d30017560bdf9490f155968397

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1544	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1092	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe
1092	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1544	1092	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	29
PID 1092 wrote to memory of 1544	1092	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	29
PID 1092 wrote to memory of 1544	1092	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	29
PID 1092 wrote to memory of 1544	1092	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	29

C:\Users\Admin\AppData\Local\Temp\6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe
"C:\Users\Admin\AppData\Local\Temp\6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-60-0x00000000768B1000-0x00000000768B3000-memory.dmp

Filesize
8KB

Download
memory/1092-66-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download