upatre | f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386

General

Target

f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe
Size

324KB
MD5

df9bd590b6f7aa14217515ee7c75ec0e
SHA1

4a452704f4ecbecd7f12e918c7f088292fc88829
SHA256

f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386
SHA512

6ce1b7bbeee4d87a9292f8465405f9ed698d0eab0a2f51c148da71528f84e02375d8789aa7179e0f0726435f22ad9daeb8d6bf0fca1b8d0f86f5a84f9ad09e32

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
4788	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1524	svchost.exe
Token: SeCreatePagefilePrivilege	1524	svchost.exe
Token: SeShutdownPrivilege	1524	svchost.exe
Token: SeCreatePagefilePrivilege	1524	svchost.exe
Token: SeShutdownPrivilege	1524	svchost.exe
Token: SeCreatePagefilePrivilege	1524	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4788	4984	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	82
PID 4984 wrote to memory of 4788	4984	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	82
PID 4984 wrote to memory of 4788	4984	f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe	82

C:\Users\Admin\AppData\Local\Temp\f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe
"C:\Users\Admin\AppData\Local\Temp\f1b853003b084bf51e21813b5782176e1d94e8177887993d6c2c3dfb04fbb386.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-133-0x000001AD9D950000-0x000001AD9D960000-memory.dmp

Filesize
64KB

Download
memory/1524-134-0x000001AD9E020000-0x000001AD9E030000-memory.dmp

Filesize
64KB

Download
memory/1524-135-0x000001ADA06D0000-0x000001ADA06D4000-memory.dmp

Filesize
16KB

Download
memory/4788-132-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing