upatre | 226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7

General

Target

226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe
Size

46KB
MD5

36e62fb67d46319f110d4f4998bc09e1
SHA1

3a0ad65b791ed8998970d478bce2f5f55a10fc1a
SHA256

226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7
SHA512

700b8d0ca032e42650e6a3122dceba50ddf2695a1199d6abe6f556c0b77ef466d3eaa6d51120ca0d19aebe713b0c17a5af14927e8f50f03a6720d72de4fead91

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1380	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1864	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe
1864	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1380	1864	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	28
PID 1864 wrote to memory of 1380	1864	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	28
PID 1864 wrote to memory of 1380	1864	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	28
PID 1864 wrote to memory of 1380	1864	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	28

C:\Users\Admin\AppData\Local\Temp\226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe
"C:\Users\Admin\AppData\Local\Temp\226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
46KB

MD5
8bb268a6fac3a451aaa55ec072d67f93

SHA1
0eb35f4f6ce5b937021faca1889a8aef274b69c9

SHA256
0c8a782ebe9a7ecc03c705c9f3d4195ea969afe1358a6b2cdc398b038a8b4bb3

SHA512
ef2b293f710a29050587d683b153a8010980e10ecc835697e74f10e1eab920f3423c44ade459386fe485be92696347722f010c918acbdd8988ced17090034609

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
46KB

MD5
8bb268a6fac3a451aaa55ec072d67f93

SHA1
0eb35f4f6ce5b937021faca1889a8aef274b69c9

SHA256
0c8a782ebe9a7ecc03c705c9f3d4195ea969afe1358a6b2cdc398b038a8b4bb3

SHA512
ef2b293f710a29050587d683b153a8010980e10ecc835697e74f10e1eab920f3423c44ade459386fe485be92696347722f010c918acbdd8988ced17090034609

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
46KB

MD5
8bb268a6fac3a451aaa55ec072d67f93

SHA1
0eb35f4f6ce5b937021faca1889a8aef274b69c9

SHA256
0c8a782ebe9a7ecc03c705c9f3d4195ea969afe1358a6b2cdc398b038a8b4bb3

SHA512
ef2b293f710a29050587d683b153a8010980e10ecc835697e74f10e1eab920f3423c44ade459386fe485be92696347722f010c918acbdd8988ced17090034609

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
46KB

MD5
8bb268a6fac3a451aaa55ec072d67f93

SHA1
0eb35f4f6ce5b937021faca1889a8aef274b69c9

SHA256
0c8a782ebe9a7ecc03c705c9f3d4195ea969afe1358a6b2cdc398b038a8b4bb3

SHA512
ef2b293f710a29050587d683b153a8010980e10ecc835697e74f10e1eab920f3423c44ade459386fe485be92696347722f010c918acbdd8988ced17090034609

Download Submit
memory/1864-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing