upatre | ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
15-05-2021 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe
Size

36KB
MD5

bf2d26257af7144f6778fadcc88416a9
SHA1

bc6220633a32a3e8a8023bd5a181b4d0ee3c3136
SHA256

ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669
SHA512

e78b13e4d7b1ed5a624f87dbd51790465b2a8a16e2327449751d24ad73837a383215bce14a7c618665b181496ffffc0dd4bd71773da397394781763c123107c7

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1572	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1756	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe
1756	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1572	1756	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	29
PID 1756 wrote to memory of 1572	1756	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	29
PID 1756 wrote to memory of 1572	1756	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	29
PID 1756 wrote to memory of 1572	1756	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	29

C:\Users\Admin\AppData\Local\Temp\ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe
"C:\Users\Admin\AppData\Local\Temp\ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-59-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1756-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download