upatre | ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8

General

Target

ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe
Size

38KB
MD5

b7c48f3e3d620598fc71e66f49f0f096
SHA1

c07243ac356c74bece436db64ce731f295424620
SHA256

ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8
SHA512

723d4e5331d6f349d5be3c35fa944516b16d1e1f64bd570fe85abd46466a4ef9e897a7ef90dcfae487519881108512f8f4d10adb4ed98f3f86ec5d0a94c86422

Score

10^/10

upatre downloader suricata

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
suricata: ET MALWARE Common Upatre Header Structure 2
suricata: ET MALWARE Common Upatre Header Structure 2
suricata
suricata: ET MALWARE Upatre Common URI Struct Dec 01 2014
suricata: ET MALWARE Upatre Common URI Struct Dec 01 2014
suricata
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

1324 szgfw.exe

pid	process
1324	szgfw.exe

Loads dropped DLL 2 IoCs

Processes:

ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe

pid	process
1796	ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe
1796	ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe

description	pid	process	target process
PID 1796 wrote to memory of 1324	1796	ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe	szgfw.exe
PID 1796 wrote to memory of 1324	1796	ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe	szgfw.exe
PID 1796 wrote to memory of 1324	1796	ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe	szgfw.exe
PID 1796 wrote to memory of 1324	1796	ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe
"C:\Users\Admin\AppData\Local\Temp\ac7f5a2f0cc27308deb8b7f5d8b6432a263d048d1d78aec31b27f26895364ce8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
38KB

MD5
2c378f385b540caea7dc3a3d909afe9d

SHA1
5c2af096257faf5fde814e2793567da6cad2df2d

SHA256
d3dd5de563490db17be739b6d017b12bcfae8e728a6f61dc1dee66a28975d777

SHA512
a672677867ca0ada06f07ac6db9247b304026210a7801009f5cdc1ce77a88faed321ea903658938ebd7535c9380f3ecaafbc4309eca05cd874d9d4f6b7083d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
38KB

MD5
2c378f385b540caea7dc3a3d909afe9d

SHA1
5c2af096257faf5fde814e2793567da6cad2df2d

SHA256
d3dd5de563490db17be739b6d017b12bcfae8e728a6f61dc1dee66a28975d777

SHA512
a672677867ca0ada06f07ac6db9247b304026210a7801009f5cdc1ce77a88faed321ea903658938ebd7535c9380f3ecaafbc4309eca05cd874d9d4f6b7083d38

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
38KB

MD5
2c378f385b540caea7dc3a3d909afe9d

SHA1
5c2af096257faf5fde814e2793567da6cad2df2d

SHA256
d3dd5de563490db17be739b6d017b12bcfae8e728a6f61dc1dee66a28975d777

SHA512
a672677867ca0ada06f07ac6db9247b304026210a7801009f5cdc1ce77a88faed321ea903658938ebd7535c9380f3ecaafbc4309eca05cd874d9d4f6b7083d38

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
38KB

MD5
2c378f385b540caea7dc3a3d909afe9d

SHA1
5c2af096257faf5fde814e2793567da6cad2df2d

SHA256
d3dd5de563490db17be739b6d017b12bcfae8e728a6f61dc1dee66a28975d777

SHA512
a672677867ca0ada06f07ac6db9247b304026210a7801009f5cdc1ce77a88faed321ea903658938ebd7535c9380f3ecaafbc4309eca05cd874d9d4f6b7083d38

Download Submit
memory/1324-57-0x0000000000000000-mapping.dmp

Download
memory/1796-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing