upatre | 4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70

Analysis

max time kernel
164s
max time network
143s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-02-2022 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe
Size

28KB
MD5

09d3ea2be0a6ce6719aaaafbd4ef03fa
SHA1

e8ca3c6bd0b0ae4053b213beb473103a7414a3a6
SHA256

4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70
SHA512

9860cb6ceb88293b0d12d47849843fd798dc72beb11e86bec0b30fe06974eaff7d779b8f51333e03defb2e2af5da4bd8a934b49791a3dd7e786808cfcb95ff4e

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1736	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe
1768	4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1736	1768	4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe	27
PID 1768 wrote to memory of 1736	1768	4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe	27
PID 1768 wrote to memory of 1736	1768	4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe	27
PID 1768 wrote to memory of 1736	1768	4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe	27

C:\Users\Admin\AppData\Local\Temp\4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe
"C:\Users\Admin\AppData\Local\Temp\4ef6634614db838cab14e24c7abdc34459a3b990c6102e4f1cccc928fdce2d70.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1768-56-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download