upatre | d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-en-20211208
submitted
19-02-2022 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe
Size

61KB
MD5

43e009dd12d10ced6e18b0fbbd55ea22
SHA1

be3e8dfaff36446c8021531fb9a0f0cd040e22d5
SHA256

d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b
SHA512

28d2c3da67a132e52f97dc5df609b87e14db9077b2c3c35fbe133cbe08d54ba07dd3d34337f999cc97cd4dbd717c3180e195d2cf4bea6a0a9934e17336f2639e

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1080	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
792	d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe
792	d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1080	792	d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe	27
PID 792 wrote to memory of 1080	792	d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe	27
PID 792 wrote to memory of 1080	792	d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe	27
PID 792 wrote to memory of 1080	792	d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe	27

C:\Users\Admin\AppData\Local\Temp\d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe
"C:\Users\Admin\AppData\Local\Temp\d6dfa16ee4ec355f5c7aa7b87ef91417039540ea9cddd35651bbe47bead7364b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download