upatre | 35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8

General

Target

35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe
Size

130KB
MD5

f79e4ace3ed9cdba0481aa3959115c8d
SHA1

c777373a214b38186632501ce81cd415da89f830
SHA256

35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8
SHA512

1b2352458e42dde3cb6c126abce48c67fe6a0a39ad88032e4b0af5c630c10b77ad95d6def7a955ad24c4cace4bf79b8454b9b14905056bc6e06e2646c064c77e

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
956	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe
532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	27
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	27
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	27
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	27

C:\Users\Admin\AppData\Local\Temp\35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe
"C:\Users\Admin\AppData\Local\Temp\35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
memory/532-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/532-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/532-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing