upatre | 6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e

Analysis

max time kernel
150s
max time network
148s
platform
windows10_x64
resource
win10v20210410
submitted
11-05-2021 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe
Size

37KB
MD5

e771548dd85c36b1e537b8f3b3becec5
SHA1

53570a0f49b441f52d8651db4500fa55b9b3e9ca
SHA256

6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e
SHA512

4d0b67503239f6db34468bfcc7907d963b85f62e08744e7368a19958a8672571380847bf35aef6c4560e43db74cebd13de49c1d30017560bdf9490f155968397

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2824	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2824	2680	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	78
PID 2680 wrote to memory of 2824	2680	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	78
PID 2680 wrote to memory of 2824	2680	6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe	78

C:\Users\Admin\AppData\Local\Temp\6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe
"C:\Users\Admin\AppData\Local\Temp\6d883f670b8d74c06c9264aeb4f702c3046e1882a3b4bd941002a52c21f7000e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-117-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/2824-118-0x0000000000410000-0x000000000055A000-memory.dmp

Filesize
1.3MB

Download