upatre | 4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84

Analysis

max time kernel
155s
max time network
132s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-02-2022 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe
Size

9KB
MD5

5519824937aeb5ab25440acf1686ec1c
SHA1

22c6833edf5c94fbaf7a02ebebac0270396df02f
SHA256

4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84
SHA512

81a19091087da4a919d8ed2725fadc101517a626bc70ff7125ac5c5ca28f92474986e4ad8db99361e0238bd88976d180dba0953390111e7d898075e2018c826b

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
576	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1412	4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe
1412	4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 576	1412	4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe	27
PID 1412 wrote to memory of 576	1412	4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe	27
PID 1412 wrote to memory of 576	1412	4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe	27
PID 1412 wrote to memory of 576	1412	4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe	27

C:\Users\Admin\AppData\Local\Temp\4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe
"C:\Users\Admin\AppData\Local\Temp\4946fa210bc8de23bed3c8d647b49fb102d0bc0ce1a17c94ba5cdaa61e770a84.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download