upatre | 35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8

General

Target

35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe
Size

130KB
MD5

f79e4ace3ed9cdba0481aa3959115c8d
SHA1

c777373a214b38186632501ce81cd415da89f830
SHA256

35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8
SHA512

1b2352458e42dde3cb6c126abce48c67fe6a0a39ad88032e4b0af5c630c10b77ad95d6def7a955ad24c4cace4bf79b8454b9b14905056bc6e06e2646c064c77e

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

956 szgfw.exe

pid	process
956	szgfw.exe

Loads dropped DLL 2 IoCs

Processes:

35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe

pid	process
532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe
532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe

description	pid	process	target process
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	szgfw.exe
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	szgfw.exe
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	szgfw.exe
PID 532 wrote to memory of 956	532	35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe
"C:\Users\Admin\AppData\Local\Temp\35b0c08624e805916b3e4488d12ba5f97a8a729d4a146c690c1b37db95ddffc8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
130KB

MD5
f2a23c26b5b26fa404d058a0b88cb965

SHA1
3b838ca4e4975cf9635ddde403de1eada2711cdc

SHA256
8217a174d67dc09ad8387403cf86926c1d615d4e5f6cfdd9fb56c53fcfa886df

SHA512
4cf33c7f1116d40130609dcd6d69d8aa8b130d0e3ffb2dfef255f642c95a2e98089cc3c5b31f51afdd907fb36e3b7203e958062768e7a841561e9052a912ed86

Download Submit
memory/532-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/532-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/532-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/956-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing