upatre | f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b

General

Target

f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
Size

35KB
MD5

4634508e493e2caa4e329c9757c9ad57
SHA1

b409510960c04881d234065e1c3267686e70916b
SHA256

f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b
SHA512

708083daf894720de5c0e3d2c1a738d5da09704b8a2e2b5b0d418f99503b161023f2521d53b34c91881f2a90d339410cb851f6d550fcb54cb310b74c195ad0d6

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

268 szgfw.exe

pid	process
268	szgfw.exe

Loads dropped DLL 2 IoCs

Processes:

f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe

pid	process
1072	f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
1072	f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe

description	pid	process	target process
PID 1072 wrote to memory of 268	1072	f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe	szgfw.exe
PID 1072 wrote to memory of 268	1072	f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe	szgfw.exe
PID 1072 wrote to memory of 268	1072	f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe	szgfw.exe
PID 1072 wrote to memory of 268	1072	f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe
"C:\Users\Admin\AppData\Local\Temp\f855ae77f9eae20b44e1a9df1cc8f78d5f5e886d70138ca76d624b73844b998b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:268

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
a666afe2e25ebe26c94596c501951180

SHA1
2e60c50a8c63abbe6eb54fb96da017361dfcaa71

SHA256
83cf82d7f89f5d34c0d7a0cffba5b7225d29ce86dbd535d5deaaa90b556b071a

SHA512
1482e54db9e38e6fd4059a9f7a1925d5d60ae1ab2d5479413e545410afac915db0905da3c5637e1a061d458b72ae0df25a885a956d40c08585ae1373b0cfd16e

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
a666afe2e25ebe26c94596c501951180

SHA1
2e60c50a8c63abbe6eb54fb96da017361dfcaa71

SHA256
83cf82d7f89f5d34c0d7a0cffba5b7225d29ce86dbd535d5deaaa90b556b071a

SHA512
1482e54db9e38e6fd4059a9f7a1925d5d60ae1ab2d5479413e545410afac915db0905da3c5637e1a061d458b72ae0df25a885a956d40c08585ae1373b0cfd16e

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
a666afe2e25ebe26c94596c501951180

SHA1
2e60c50a8c63abbe6eb54fb96da017361dfcaa71

SHA256
83cf82d7f89f5d34c0d7a0cffba5b7225d29ce86dbd535d5deaaa90b556b071a

SHA512
1482e54db9e38e6fd4059a9f7a1925d5d60ae1ab2d5479413e545410afac915db0905da3c5637e1a061d458b72ae0df25a885a956d40c08585ae1373b0cfd16e

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
a666afe2e25ebe26c94596c501951180

SHA1
2e60c50a8c63abbe6eb54fb96da017361dfcaa71

SHA256
83cf82d7f89f5d34c0d7a0cffba5b7225d29ce86dbd535d5deaaa90b556b071a

SHA512
1482e54db9e38e6fd4059a9f7a1925d5d60ae1ab2d5479413e545410afac915db0905da3c5637e1a061d458b72ae0df25a885a956d40c08585ae1373b0cfd16e

Download Submit
memory/268-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1072-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing