upatre | ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
15/05/2021, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe
Size

36KB
MD5

bf2d26257af7144f6778fadcc88416a9
SHA1

bc6220633a32a3e8a8023bd5a181b4d0ee3c3136
SHA256

ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669
SHA512

e78b13e4d7b1ed5a624f87dbd51790465b2a8a16e2327449751d24ad73837a383215bce14a7c618665b181496ffffc0dd4bd71773da397394781763c123107c7

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
3300	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3300	3872	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	78
PID 3872 wrote to memory of 3300	3872	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	78
PID 3872 wrote to memory of 3300	3872	ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe	78

C:\Users\Admin\AppData\Local\Temp\ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe
"C:\Users\Admin\AppData\Local\Temp\ea310f185a37d7c33afa8ba5dccfeec3dddc0356ed82596006374bdd95bdd669.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3872-114-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download