Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 02:28
Static task
static1
Behavioral task
behavioral1
Sample
e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe
Resource
win10v20210410
General
-
Target
e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe
-
Size
37KB
-
MD5
28c86684494054977a80990f240b0cdb
-
SHA1
027fa7ed6b914f37f8c9b516be0622da80a8e582
-
SHA256
e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50
-
SHA512
164ba7d2a8e123862539e2b7fe58c84be8604344aba9acf7df57bc140c9be964847d1653d69f65dfdbe40ff1f5a3db0f00dc13e41cce7a8b7b1cf3ed0b877615
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
Processes:
szgfw.exepid process 2828 szgfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exedescription pid process target process PID 3176 wrote to memory of 2828 3176 e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe szgfw.exe PID 3176 wrote to memory of 2828 3176 e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe szgfw.exe PID 3176 wrote to memory of 2828 3176 e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe szgfw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe"C:\Users\Admin\AppData\Local\Temp\e5b03b94b3a30c6cbc2239052edfe92cc4b7456fcaf664b32e439c5e571c7e50.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
68a937a939d8fe3a7d2c7af3fee09ec5
SHA1d15870e5ec02147cfdb6d0f64fa636c901b04a80
SHA256ca71c461156986927795d42f3f256a5f43ba040e107ffe5c7e5ec2835ee1e9f7
SHA5122bee0b9b8802ee3a9b2393425bc8a390bfed41f58e642ff83da43333af426d6a9cfb5efdff22e418f690973aa69949919a9104e2dacb64257a3f0b86919f42d4
-
MD5
68a937a939d8fe3a7d2c7af3fee09ec5
SHA1d15870e5ec02147cfdb6d0f64fa636c901b04a80
SHA256ca71c461156986927795d42f3f256a5f43ba040e107ffe5c7e5ec2835ee1e9f7
SHA5122bee0b9b8802ee3a9b2393425bc8a390bfed41f58e642ff83da43333af426d6a9cfb5efdff22e418f690973aa69949919a9104e2dacb64257a3f0b86919f42d4