upatre | 3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe
Size

6KB
MD5

52bc0188ba93adafc4bf811f89d4ff3f
SHA1

85a53b0b39932489b28f348af4b346796b85d056
SHA256

3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1
SHA512

c725d0ca33fff006dfaaf64f3e4300f49885e96bae165920710eca4db2e0c399b94e8ac5dc08c0ab9ad14608ec0691bdee0bc55a3f06efbd11d261a17bffcc97

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1864	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1864	1844	3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe	81
PID 1844 wrote to memory of 1864	1844	3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe	81
PID 1844 wrote to memory of 1864	1844	3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe	81

C:\Users\Admin\AppData\Local\Temp\3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe
"C:\Users\Admin\AppData\Local\Temp\3d1c1a676b271612ebca5d9f019730e2505092b5a507accc1e2b1460dee79da1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
6KB

MD5
138337ca239b590aae9553e75c372ae3

SHA1
27c2d358062528eec3c229b8ac102b8d0814d5fe

SHA256
bcb5f68f14b6f1fc37d00ae6fa1a17c77ff9aa8162661f9761eb0fe6f90d65ea

SHA512
000016b48b1ca4103daef18e46bc80c28b5c03a7d6f4dfa361b88d1b169450c5b84fb683766767e73d25e95e803457b1bb306ebaf4b10e47cb42591cd5aadbce

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
6KB

MD5
138337ca239b590aae9553e75c372ae3

SHA1
27c2d358062528eec3c229b8ac102b8d0814d5fe

SHA256
bcb5f68f14b6f1fc37d00ae6fa1a17c77ff9aa8162661f9761eb0fe6f90d65ea

SHA512
000016b48b1ca4103daef18e46bc80c28b5c03a7d6f4dfa361b88d1b169450c5b84fb683766767e73d25e95e803457b1bb306ebaf4b10e47cb42591cd5aadbce

Download Submit