upatre | cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7v20210410
submitted
15-05-2021 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
Size

37KB
MD5

be3ae3f329e4b10558bae1155b346fae
SHA1

829259d0ad637af5c1251148477c67a02cd47dc0
SHA256

cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6
SHA512

dfdbfd2f5264f1904958fa32e46e375b5f081061bf546a19c809fa116327b9130665753a9100df03e9e9011ac9ec63f51d7cfbf220479383631ed21ace5363aa

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1280	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1104	cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
1104	cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1280	1104	cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe	29
PID 1104 wrote to memory of 1280	1104	cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe	29
PID 1104 wrote to memory of 1280	1104	cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe	29
PID 1104 wrote to memory of 1280	1104	cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe	29

C:\Users\Admin\AppData\Local\Temp\cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe
"C:\Users\Admin\AppData\Local\Temp\cc6894249ef6551a1acc49084a5c8258fbeb86f65822f4bae9323dbe82b6ede6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-60-0x0000000076E11000-0x0000000076E13000-memory.dmp

Filesize
8KB

Download
memory/1104-66-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download