upatre | b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96

Analysis

max time kernel
200s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09/03/2022, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe
Size

35KB
MD5

01a6747288c06724ec9d3bde416ec009
SHA1

b10f2049c59ec194444e1248d2fc356b0a68f0bb
SHA256

b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96
SHA512

2935405634c6075558abcb129d96a03615f8ff800dc7d2407d85cc8a6455ad6c4fa877c0e6fab7bad83109a434037392a265156c3fd0ded0143044cfdd7573cd

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
4692	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4692	1940	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	81
PID 1940 wrote to memory of 4692	1940	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	81
PID 1940 wrote to memory of 4692	1940	b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe	81

C:\Users\Admin\AppData\Local\Temp\b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe
"C:\Users\Admin\AppData\Local\Temp\b2c068efce2f4cdcc15263f48d1cb353c605b571d944cb78560d069c4ea3ed96.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-130-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download