upatre | 337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6

General

Target

337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe
Size

607KB
MD5

6b652b5c7c5224113c295493083800ba
SHA1

69c36cc23cf3d07619b548a8dd80d2de260a7171
SHA256

337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6
SHA512

b85614dd89a94b6dd43f68a83dd17fe922adbd9c3696b3de7ec1bf64cc52459be01d93c24cf31b102e7e33604da9fe3cb0f4de4e91207b6860c2f8adfd2ef597

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1456	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1868	337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe
1868	337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1456	1868	337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe	26
PID 1868 wrote to memory of 1456	1868	337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe	26
PID 1868 wrote to memory of 1456	1868	337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe	26
PID 1868 wrote to memory of 1456	1868	337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe	26

C:\Users\Admin\AppData\Local\Temp\337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe
"C:\Users\Admin\AppData\Local\Temp\337ab03fe0907ec65570d11d52cfd0e74d3804ca8ec53419ee4a832bb3b47db6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
608KB

MD5
a2380115e38c05e743b69c8132a27987

SHA1
ec4508bfb5dd5dc2cfdc866980a64239fb19bdb7

SHA256
58dd16bc67f303729413d2feb8e9044e77c1ea78ebd9d14b7f3b5f88d1ede598

SHA512
0c74082bb2eab6c1d9d395bf6824ab8e0a246b010aeff01c2a6c18524a7ab6728afa4843de93e3cca350002f6ea4335a083bdafea9e89fc6b7f82a3de0d7c1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
608KB

MD5
a2380115e38c05e743b69c8132a27987

SHA1
ec4508bfb5dd5dc2cfdc866980a64239fb19bdb7

SHA256
58dd16bc67f303729413d2feb8e9044e77c1ea78ebd9d14b7f3b5f88d1ede598

SHA512
0c74082bb2eab6c1d9d395bf6824ab8e0a246b010aeff01c2a6c18524a7ab6728afa4843de93e3cca350002f6ea4335a083bdafea9e89fc6b7f82a3de0d7c1ee

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
608KB

MD5
a2380115e38c05e743b69c8132a27987

SHA1
ec4508bfb5dd5dc2cfdc866980a64239fb19bdb7

SHA256
58dd16bc67f303729413d2feb8e9044e77c1ea78ebd9d14b7f3b5f88d1ede598

SHA512
0c74082bb2eab6c1d9d395bf6824ab8e0a246b010aeff01c2a6c18524a7ab6728afa4843de93e3cca350002f6ea4335a083bdafea9e89fc6b7f82a3de0d7c1ee

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
608KB

MD5
a2380115e38c05e743b69c8132a27987

SHA1
ec4508bfb5dd5dc2cfdc866980a64239fb19bdb7

SHA256
58dd16bc67f303729413d2feb8e9044e77c1ea78ebd9d14b7f3b5f88d1ede598

SHA512
0c74082bb2eab6c1d9d395bf6824ab8e0a246b010aeff01c2a6c18524a7ab6728afa4843de93e3cca350002f6ea4335a083bdafea9e89fc6b7f82a3de0d7c1ee

Download Submit
memory/1868-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing