upatre | 7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1

Analysis

max time kernel
151s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
19-02-2022 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe
Size

70KB
MD5

f1e6bdc66df83d79274a291b2055a4b8
SHA1

ed66b61e4fd8799dc5fbabcc3e11b11e8eb29cb7
SHA256

7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1
SHA512

6525a01d3bda855498422473eb63357e0f9f0f0570705cb963715b5b353f5ebf788ee4c53b1393fa12dd2032a3e5a5788974d8de9433ce5c6eb48f15b0476ddc

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
572	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1504	7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe
1504	7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 572	1504	7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe	27
PID 1504 wrote to memory of 572	1504	7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe	27
PID 1504 wrote to memory of 572	1504	7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe	27
PID 1504 wrote to memory of 572	1504	7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe	27

C:\Users\Admin\AppData\Local\Temp\7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe
"C:\Users\Admin\AppData\Local\Temp\7cc3ad22c9863e664de7f5272c152bc4e2c9f189d201815cdc3a22abdceaa4f1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download