upatre | b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96

Analysis

max time kernel
4294239s
max time network
151s
platform
windows7_x64
resource
win7-20220223-en
submitted
09-03-2022 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe
Size

35KB
MD5

01a6747288c06724ec9d3bde416ec009
SHA1

b10f2049c59ec194444e1248d2fc356b0a68f0bb
SHA256

b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96
SHA512

2935405634c6075558abcb129d96a03615f8ff800dc7d2407d85cc8a6455ad6c4fa877c0e6fab7bad83109a434037392a265156c3fd0ded0143044cfdd7573cd

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1508	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1328	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe
1328	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1508	1328	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	29
PID 1328 wrote to memory of 1508	1328	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	29
PID 1328 wrote to memory of 1508	1328	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	29
PID 1328 wrote to memory of 1508	1328	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	29

C:\Users\Admin\AppData\Local\Temp\b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe
"C:\Users\Admin\AppData\Local\Temp\b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1328-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download