upatre | 2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b

Analysis

max time kernel
150s
max time network
52s
platform
windows10_x64
resource
win10v20210408
submitted
15-05-2021 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe
Size

27KB
MD5

c12af74af62fe7caf1596976bee43aa9
SHA1

811fd90a42975131061427412ec9f92c0c509510
SHA256

2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b
SHA512

68b1a0e656109f4e4b3575f5b3692c549a7fa711bba6ca2d9909f3edc32030f65d4314dfbdce2773d6fab824f106d5d223eaa626bae8e0b2e8745b2c32fcc6e8

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2852	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2852	572	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	77
PID 572 wrote to memory of 2852	572	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	77
PID 572 wrote to memory of 2852	572	2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe	77

C:\Users\Admin\AppData\Local\Temp\2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe
"C:\Users\Admin\AppData\Local\Temp\2720bb3960e71e398851471b92ceb9877334c73e0df3c782e71e0d0aa238544b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-114-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download