upatre | fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308

Analysis

max time kernel
151s
max time network
61s
platform
windows10_x64
resource
win10v20210408
submitted
17-05-2021 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
Size

42KB
MD5

7d927e891d090be9edd8fd45e735261f
SHA1

8b8e1bfe925f9af7fedd75a93c2f4f0280903c91
SHA256

fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308
SHA512

5ad97895d7c1f37aa9dcacd161c13978fc4ee34f9baa5e1b985911dc2dd13333f4114e4dc291f1e6d66100ce97d61c4b6ab82e62a1c5c5889c7dca84b2519867

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
708	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 708	624	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	75
PID 624 wrote to memory of 708	624	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	75
PID 624 wrote to memory of 708	624	fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe	75

C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe
"C:\Users\Admin\AppData\Local\Temp\fa4c429aba5232aa2d98dbf68228746714e50978c8cdb304e766c9b385303308.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-114-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/708-118-0x0000000000410000-0x000000000055A000-memory.dmp

Filesize
1.3MB

Download