upatre | 780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26

Analysis

max time kernel
152s
max time network
128s
platform
windows7_x64
resource
win7-en-20211208
submitted
19-02-2022 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe
Size

602KB
MD5

c2ad512c66d042decb8a42b6df62845e
SHA1

39e0fcdcd59dc2df658861266cfce9f58d6c9e5c
SHA256

780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26
SHA512

5937276daabe890186e27c45aaede3e0954d89ca95140337f6c7f7c849acc76443c91ef01441ccf49587c84d7454268de711ef27c4356b1fd7f710abdad86a40

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1764	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1512	780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe
1512	780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1764	1512	780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe	27
PID 1512 wrote to memory of 1764	1512	780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe	27
PID 1512 wrote to memory of 1764	1512	780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe	27
PID 1512 wrote to memory of 1764	1512	780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe	27

C:\Users\Admin\AppData\Local\Temp\780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe
"C:\Users\Admin\AppData\Local\Temp\780681863b30a566dc51bbf75ee05206af8cbf024bfbf39d9321efea6ad2ad26.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1764-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download