upatre | f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386

General

Target

f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe
Size

324KB
MD5

df9bd590b6f7aa14217515ee7c75ec0e
SHA1

4a452704f4ecbecd7f12e918c7f088292fc88829
SHA256

f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386
SHA512

6ce1b7bbeee4d87a9292f8465405f9ed698d0eab0a2f51c148da71528f84e02375d8789aa7179e0f0726435f22ad9daeb8d6bf0fca1b8d0f86f5a84f9ad09e32

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

320 szgfw.exe

pid	process
320	szgfw.exe

Loads dropped DLL 2 IoCs

Processes:

f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe

pid	process
1220	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe
1220	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe

description	pid	process	target process
PID 1220 wrote to memory of 320	1220	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	szgfw.exe
PID 1220 wrote to memory of 320	1220	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	szgfw.exe
PID 1220 wrote to memory of 320	1220	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	szgfw.exe
PID 1220 wrote to memory of 320	1220	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe
"C:\Users\Admin\AppData\Local\Temp\f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:320

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
3daf890b02a5deea5ac897f3aca2dddf

SHA1
a148d1417524be9d76d1222691b051826ed7c8e5

SHA256
b276f4b4aeceeba0588113f9460335b8d31c8a954a53c572b22a810399e22e15

SHA512
3a0bea504637f026a6c9f74554f650c04496349a154ca11a30f45159982950dbf9f00d4f4dda24279d618d5b41cc1954a247a1077990b987720bf7e3639bd9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
3daf890b02a5deea5ac897f3aca2dddf

SHA1
a148d1417524be9d76d1222691b051826ed7c8e5

SHA256
b276f4b4aeceeba0588113f9460335b8d31c8a954a53c572b22a810399e22e15

SHA512
3a0bea504637f026a6c9f74554f650c04496349a154ca11a30f45159982950dbf9f00d4f4dda24279d618d5b41cc1954a247a1077990b987720bf7e3639bd9f1

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
3daf890b02a5deea5ac897f3aca2dddf

SHA1
a148d1417524be9d76d1222691b051826ed7c8e5

SHA256
b276f4b4aeceeba0588113f9460335b8d31c8a954a53c572b22a810399e22e15

SHA512
3a0bea504637f026a6c9f74554f650c04496349a154ca11a30f45159982950dbf9f00d4f4dda24279d618d5b41cc1954a247a1077990b987720bf7e3639bd9f1

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
3daf890b02a5deea5ac897f3aca2dddf

SHA1
a148d1417524be9d76d1222691b051826ed7c8e5

SHA256
b276f4b4aeceeba0588113f9460335b8d31c8a954a53c572b22a810399e22e15

SHA512
3a0bea504637f026a6c9f74554f650c04496349a154ca11a30f45159982950dbf9f00d4f4dda24279d618d5b41cc1954a247a1077990b987720bf7e3639bd9f1

Download Submit
memory/320-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1220-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing