Analysis
-
max time kernel
48s -
max time network
78s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
18-05-2021 03:13
General
-
Target
eb91ffc89ec2cd991afe4f974f90bfed2c6788eb050d97caf68f7a96d1f22460.exe
-
Size
10KB
-
MD5
3802b164cb32c25a6c6bc9bb03640f28
-
SHA1
e671f284f66b4bea2e0aa95daa82cbf2a0442f40
-
SHA256
eb91ffc89ec2cd991afe4f974f90bfed2c6788eb050d97caf68f7a96d1f22460
-
SHA512
f42bd392bf5f9ff8686971cad6b6f2fd70160597c69aa4b19172218807e3fcfc7fcbe4185f29148d6719d5333f71fb624b7b6e4f6e5f83c01ac735986392bf37
Score
10/10
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb91ffc89ec2cd991afe4f974f90bfed2c6788eb050d97caf68f7a96d1f22460.exe"C:\Users\Admin\AppData\Local\Temp\eb91ffc89ec2cd991afe4f974f90bfed2c6788eb050d97caf68f7a96d1f22460.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
-