Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    15-05-2021 11:27

General

  • Target

    a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe

  • Size

    36KB

  • MD5

    ce9dde5bf38fb9b4d5ac7da86e4afa5a

  • SHA1

    5d7c38210b2e4780db39c28fc842ab702908491e

  • SHA256

    a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143

  • SHA512

    f9a2d0e6e7756a22b346eed5363bf2492b0627dbdd2aba7a975b4b3c219d289fdba56368b757445f8121ff7eb5b9a0690516019012030d800d550931b9b55126

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe
    "C:\Users\Admin\AppData\Local\Temp\a3d45e61a9ced1862ec30979b63d8dd56db07777336d1845b80b5ac70577e143.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1624

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    6ae7161c76a4ef112144024764edea7f

    SHA1

    7b73dc93df6cc9b99b75524989a7164903420f65

    SHA256

    de41f88b412eef0eeaedd204655736184cafad2e88c60532cd4b97394fbb1219

    SHA512

    e25582579657212eac3c6fd3b46ac8125a295d43be93dc5695ab04a6264cab0b0e2cc025e9be24a3c319ecdce2ddf936a10c59258e7270f16922b38aca4744e6

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    6ae7161c76a4ef112144024764edea7f

    SHA1

    7b73dc93df6cc9b99b75524989a7164903420f65

    SHA256

    de41f88b412eef0eeaedd204655736184cafad2e88c60532cd4b97394fbb1219

    SHA512

    e25582579657212eac3c6fd3b46ac8125a295d43be93dc5695ab04a6264cab0b0e2cc025e9be24a3c319ecdce2ddf936a10c59258e7270f16922b38aca4744e6

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    6ae7161c76a4ef112144024764edea7f

    SHA1

    7b73dc93df6cc9b99b75524989a7164903420f65

    SHA256

    de41f88b412eef0eeaedd204655736184cafad2e88c60532cd4b97394fbb1219

    SHA512

    e25582579657212eac3c6fd3b46ac8125a295d43be93dc5695ab04a6264cab0b0e2cc025e9be24a3c319ecdce2ddf936a10c59258e7270f16922b38aca4744e6

  • \Users\Admin\AppData\Local\Temp\szgfw.exe

    MD5

    6ae7161c76a4ef112144024764edea7f

    SHA1

    7b73dc93df6cc9b99b75524989a7164903420f65

    SHA256

    de41f88b412eef0eeaedd204655736184cafad2e88c60532cd4b97394fbb1219

    SHA512

    e25582579657212eac3c6fd3b46ac8125a295d43be93dc5695ab04a6264cab0b0e2cc025e9be24a3c319ecdce2ddf936a10c59258e7270f16922b38aca4744e6

  • memory/1624-62-0x0000000000000000-mapping.dmp

  • memory/1656-59-0x0000000075801000-0x0000000075803000-memory.dmp

    Filesize

    8KB

  • memory/1656-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB