Analysis

  • max time kernel
    149s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    15-05-2021 04:00

General

  • Target

    ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe

  • Size

    37KB

  • MD5

    c6ce2916ab16c24a4e14c77c44528b5d

  • SHA1

    acf178075e194811ca6fdbf1b6152b953cf9459a

  • SHA256

    ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc

  • SHA512

    c15a0526cfb1bf8d614e7c5b7a6b91e4eefb3c63091c32eaca1c8e2343935107363ea609e13d9cd70e303eaee81ba71fb357a5a728241e8caaf878ea0c88cac4

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe
    "C:\Users\Admin\AppData\Local\Temp\ea8327e4770813a6bdf201ca0daf2740a063ccebdbcae88246a67e6a1c4314cc.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1244

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    f73acd0199c38a8781f3c18c90d568dd

    SHA1

    33262f944d99a17eb7ec1e441132054a1b3eeb6b

    SHA256

    07bea016a8c06ada01eaff95cc407078865c75d1f48c639200f47a755dc7e43e

    SHA512

    b5cedc314eddaadabc16e4765a38f84d0583b365211b8e1e277ddeb68ad13c98d35a06f2fc779f2e6cbbac0efbccfb16f5e0a777f5c17c0d5bd46a88d99c1fc8

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    f73acd0199c38a8781f3c18c90d568dd

    SHA1

    33262f944d99a17eb7ec1e441132054a1b3eeb6b

    SHA256

    07bea016a8c06ada01eaff95cc407078865c75d1f48c639200f47a755dc7e43e

    SHA512

    b5cedc314eddaadabc16e4765a38f84d0583b365211b8e1e277ddeb68ad13c98d35a06f2fc779f2e6cbbac0efbccfb16f5e0a777f5c17c0d5bd46a88d99c1fc8

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    f73acd0199c38a8781f3c18c90d568dd

    SHA1

    33262f944d99a17eb7ec1e441132054a1b3eeb6b

    SHA256

    07bea016a8c06ada01eaff95cc407078865c75d1f48c639200f47a755dc7e43e

    SHA512

    b5cedc314eddaadabc16e4765a38f84d0583b365211b8e1e277ddeb68ad13c98d35a06f2fc779f2e6cbbac0efbccfb16f5e0a777f5c17c0d5bd46a88d99c1fc8

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    f73acd0199c38a8781f3c18c90d568dd

    SHA1

    33262f944d99a17eb7ec1e441132054a1b3eeb6b

    SHA256

    07bea016a8c06ada01eaff95cc407078865c75d1f48c639200f47a755dc7e43e

    SHA512

    b5cedc314eddaadabc16e4765a38f84d0583b365211b8e1e277ddeb68ad13c98d35a06f2fc779f2e6cbbac0efbccfb16f5e0a777f5c17c0d5bd46a88d99c1fc8

  • memory/368-59-0x0000000075C31000-0x0000000075C33000-memory.dmp

    Filesize

    8KB

  • memory/368-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1244-62-0x0000000000000000-mapping.dmp