upatre | 4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a

Analysis

max time kernel
154s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-07-2022 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe
Size

40KB
MD5

a83a09492553df08220b4f460683b6e5
SHA1

b468488bd828f106ce4bf9473f401f3fc4d1344a
SHA256

4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a
SHA512

e3ea8ef53c5446ccdf2f133219af26b06774c2c67ea1b767f3e7b407690e7374df75779a5032b0c74f0943b1aa161fb3f61a6e5a2962503b6f5b2c3959a5831c

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1176	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1176	1700	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	79
PID 1700 wrote to memory of 1176	1700	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	79
PID 1700 wrote to memory of 1176	1700	4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe	79

C:\Users\Admin\AppData\Local\Temp\4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe
"C:\Users\Admin\AppData\Local\Temp\4593122c643d3e8881c8057a37cfb51084d12d34ad8870f5d3e5547fbed2512a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
40KB

MD5
0cc97835125ea2f951de99da0b3d9913

SHA1
3c60d61b04e6a4dc0dc875b379082606db7b499b

SHA256
92722e12b4002e203d8f9f277e2776449060c1c112bc64174ed9b4dd4cdb3b92

SHA512
a088965a0864906e4bf260de41dd7f6664458ee4fddffe47bcc7be6f917b110d838f4e6a797ee127a8aab479afb3fe5c03ae82fba72eab29cea07ba2e9fbbf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
40KB

MD5
0cc97835125ea2f951de99da0b3d9913

SHA1
3c60d61b04e6a4dc0dc875b379082606db7b499b

SHA256
92722e12b4002e203d8f9f277e2776449060c1c112bc64174ed9b4dd4cdb3b92

SHA512
a088965a0864906e4bf260de41dd7f6664458ee4fddffe47bcc7be6f917b110d838f4e6a797ee127a8aab479afb3fe5c03ae82fba72eab29cea07ba2e9fbbf71

Download Submit