upatre | fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308

Analysis

max time kernel
149s
max time network
45s
platform
windows7_x64
resource
win7v20210408
submitted
17-05-2021 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
Size

42KB
MD5

7d927e891d090be9edd8fd45e735261f
SHA1

8b8e1bfe925f9af7fedd75a93c2f4f0280903c91
SHA256

fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308
SHA512

5ad97895d7c1f37aa9dcacd161c13978fc4ee34f9baa5e1b985911dc2dd13333f4114e4dc291f1e6d66100ce97d61c4b6ab82e62a1c5c5889c7dca84b2519867

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
656	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1984	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
1984	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 656	1984	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	29
PID 1984 wrote to memory of 656	1984	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	29
PID 1984 wrote to memory of 656	1984	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	29
PID 1984 wrote to memory of 656	1984	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	29

C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
"C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-59-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1984-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download