upatre | 226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7

Analysis

max time kernel
150s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-06-2022 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe
Size

46KB
MD5

36e62fb67d46319f110d4f4998bc09e1
SHA1

3a0ad65b791ed8998970d478bce2f5f55a10fc1a
SHA256

226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7
SHA512

700b8d0ca032e42650e6a3122dceba50ddf2695a1199d6abe6f556c0b77ef466d3eaa6d51120ca0d19aebe713b0c17a5af14927e8f50f03a6720d72de4fead91

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
4324	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4324	3932	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	83
PID 3932 wrote to memory of 4324	3932	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	83
PID 3932 wrote to memory of 4324	3932	226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe	83

C:\Users\Admin\AppData\Local\Temp\226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe
"C:\Users\Admin\AppData\Local\Temp\226cded9b650c300a03ce08e7f88f345ba868d92e1466110d1dff8a84e784fd7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
46KB

MD5
8bb268a6fac3a451aaa55ec072d67f93

SHA1
0eb35f4f6ce5b937021faca1889a8aef274b69c9

SHA256
0c8a782ebe9a7ecc03c705c9f3d4195ea969afe1358a6b2cdc398b038a8b4bb3

SHA512
ef2b293f710a29050587d683b153a8010980e10ecc835697e74f10e1eab920f3423c44ade459386fe485be92696347722f010c918acbdd8988ced17090034609

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
46KB

MD5
8bb268a6fac3a451aaa55ec072d67f93

SHA1
0eb35f4f6ce5b937021faca1889a8aef274b69c9

SHA256
0c8a782ebe9a7ecc03c705c9f3d4195ea969afe1358a6b2cdc398b038a8b4bb3

SHA512
ef2b293f710a29050587d683b153a8010980e10ecc835697e74f10e1eab920f3423c44ade459386fe485be92696347722f010c918acbdd8988ced17090034609

Download Submit