upatre | 230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/06/2022, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe
Size 41KB
Sample220612-dnd26sbfhp
SHA256 230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221
MD5 a480225e454330cadd3032ef1a33680c
SHA1 d4db1606be1b24968f15eedad095743711da90cf
SHA512 380f4a9a3403ea90695cc973c6d9c89ca08ba16652965a864afe7b32b86237f07bf54a59d7924fc90d7995ed8ccd670a9709b790c81c2f3b6009194c9bf196bb
MD5 SHA1 SHA512

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
4128	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4128	4220	230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe	83
PID 4220 wrote to memory of 4128	4220	230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe	83
PID 4220 wrote to memory of 4128	4220	230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe	83

C:\Users\Admin\AppData\Local\Temp\230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe
"C:\Users\Admin\AppData\Local\Temp\230016b8d26b4672b9e441061bbce9bfa73340fd0537f9b5393e37aa598cc221.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szgfw.exe

Path C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Size 41KB
SHA256 6dd207c43369b66e9053ef7c584de8fc7071c196aa5daa8a1a03a4dcbc478f9f
MD5 fbe23349cd3b828c56012656131665d7
SHA1 f412f347ed3f7cb885ab92717c986971685dc76b
SHA512 ad55e09d04ac202baf8343457552634f9a77026799cf7f9eb2a3b25bdb5a2cc58ac2d409bec6e05cf016bc2f22e9d8f5ca26bc69593a8d2a069aa362c9965409
SSDEEP 768:Xf1Y9RRw/dUT6vurGd/pkUOyGAv+rR95k5mwflylylylFb:dY9jw/dUT62rGdiUOWWr9mZC
MD5 SHA1 SHA512 SSDEEP

Submit Download