upatre | 50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed

General

Target

50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe
Size

33KB
MD5

0cbebb3686024b0a5dfad7174a57e9a0
SHA1

85f06f2fb7eef42e28439142a934f0e2e8d6e5eb
SHA256

50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed
SHA512

6cb1bd3f91a406bb8acb484799c993d7d790e984a928c8ab53882adbb4755bc189af1acd90888acdf971baef37d103fb28b2142136b4ea6cfc7a4d6a9395e535

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

544 szgfw.exe

pid	process
544	szgfw.exe

Loads dropped DLL 2 IoCs

Processes:

50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe

pid	process
800	50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe
800	50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe

description	pid	process	target process
PID 800 wrote to memory of 544	800	50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe	szgfw.exe
PID 800 wrote to memory of 544	800	50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe	szgfw.exe
PID 800 wrote to memory of 544	800	50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe	szgfw.exe
PID 800 wrote to memory of 544	800	50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe
"C:\Users\Admin\AppData\Local\Temp\50ddbe973c0883f70ade80a264c3c9995331fb97ec45154ed55f7907de4969ed.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:544

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
6ac62eaa4d5f2281a2270ab4c8c030e6

SHA1
72f5d34cdd9a38ae1a7d69b8c88f0467477f92f2

SHA256
f603fe1f6ed813ca54c3e2f27008681ebcca05dd99351f7bf5c3abe8abf2d34b

SHA512
7c7a4b59b45e35c890cede2464b987f48fc931e5278aa3bc1c1e05ce1dc0eb399a7fb992cb85b6dd23d75e2e7d17b24345b4432f30784a7451a0e324e5c2d664

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
6ac62eaa4d5f2281a2270ab4c8c030e6

SHA1
72f5d34cdd9a38ae1a7d69b8c88f0467477f92f2

SHA256
f603fe1f6ed813ca54c3e2f27008681ebcca05dd99351f7bf5c3abe8abf2d34b

SHA512
7c7a4b59b45e35c890cede2464b987f48fc931e5278aa3bc1c1e05ce1dc0eb399a7fb992cb85b6dd23d75e2e7d17b24345b4432f30784a7451a0e324e5c2d664

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
6ac62eaa4d5f2281a2270ab4c8c030e6

SHA1
72f5d34cdd9a38ae1a7d69b8c88f0467477f92f2

SHA256
f603fe1f6ed813ca54c3e2f27008681ebcca05dd99351f7bf5c3abe8abf2d34b

SHA512
7c7a4b59b45e35c890cede2464b987f48fc931e5278aa3bc1c1e05ce1dc0eb399a7fb992cb85b6dd23d75e2e7d17b24345b4432f30784a7451a0e324e5c2d664

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
MD5
6ac62eaa4d5f2281a2270ab4c8c030e6

SHA1
72f5d34cdd9a38ae1a7d69b8c88f0467477f92f2

SHA256
f603fe1f6ed813ca54c3e2f27008681ebcca05dd99351f7bf5c3abe8abf2d34b

SHA512
7c7a4b59b45e35c890cede2464b987f48fc931e5278aa3bc1c1e05ce1dc0eb399a7fb992cb85b6dd23d75e2e7d17b24345b4432f30784a7451a0e324e5c2d664

Download Submit
memory/800-53-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/800-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing