upatre | 2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b

Analysis

max time kernel
151s
max time network
15s
platform
windows7_x64
resource
win7v20210408
submitted
15-05-2021 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe
Size

27KB
MD5

c12af74af62fe7caf1596976bee43aa9
SHA1

811fd90a42975131061427412ec9f92c0c509510
SHA256

2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b
SHA512

68b1a0e656109f4e4b3575f5b3692c549a7fa711bba6ca2d9909f3edc32030f65d4314dfbdce2773d6fab824f106d5d223eaa626bae8e0b2e8745b2c32fcc6e8

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1676	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1944	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe
1944	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1676	1944	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	29
PID 1944 wrote to memory of 1676	1944	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	29
PID 1944 wrote to memory of 1676	1944	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	29
PID 1944 wrote to memory of 1676	1944	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	29

C:\Users\Admin\AppData\Local\Temp\2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe
"C:\Users\Admin\AppData\Local\Temp\2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-60-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1944-66-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download