upatre | 0f8435b29e045cd3b2c0429dcdc16b6986369dd51a5c72e6d1866c74cad401d1

Analysis

max time kernel
151s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
15-07-2022 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.exe
Size

17KB
MD5

1f5b84262800540708145eb95744bb10
SHA1

59014ed1a05f10037dd995490b98276ee809e00e
SHA256

0f8435b29e045cd3b2c0429dcdc16b6986369dd51a5c72e6d1866c74cad401d1
SHA512

0b7f6cbd348aa8ae5f75f766c05a88806b3a8e0e33126f621c7358fa075fd02973ede5d70b21f06078d98de6d82761a8ce9ce299b3e701cf4cefaf5e1c98cdd5

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2032	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1492	virussign.exe
1492	virussign.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2032	1492	virussign.exe	27
PID 1492 wrote to memory of 2032	1492	virussign.exe	27
PID 1492 wrote to memory of 2032	1492	virussign.exe	27
PID 1492 wrote to memory of 2032	1492	virussign.exe	27

C:\Users\Admin\AppData\Local\Temp\virussign.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
17KB

MD5
8725d51097af51b2056386a3029369e4

SHA1
d05dc980227c426d04d7927ec1c457c8ab7a40c6

SHA256
c361c6c256e8d3bfa44b3e441cf925c4475eb012946b9443fcd73a0e0ea28dd5

SHA512
35fd7d55b527218e4382d026f40ea860bfced6c3f98e8c3fdbd0ec5697feae802b4c9d460fc5e3d1b96a2bcb084973776e3bab77ca95655c241cb35b283fe2b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
17KB

MD5
8725d51097af51b2056386a3029369e4

SHA1
d05dc980227c426d04d7927ec1c457c8ab7a40c6

SHA256
c361c6c256e8d3bfa44b3e441cf925c4475eb012946b9443fcd73a0e0ea28dd5

SHA512
35fd7d55b527218e4382d026f40ea860bfced6c3f98e8c3fdbd0ec5697feae802b4c9d460fc5e3d1b96a2bcb084973776e3bab77ca95655c241cb35b283fe2b7

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
17KB

MD5
8725d51097af51b2056386a3029369e4

SHA1
d05dc980227c426d04d7927ec1c457c8ab7a40c6

SHA256
c361c6c256e8d3bfa44b3e441cf925c4475eb012946b9443fcd73a0e0ea28dd5

SHA512
35fd7d55b527218e4382d026f40ea860bfced6c3f98e8c3fdbd0ec5697feae802b4c9d460fc5e3d1b96a2bcb084973776e3bab77ca95655c241cb35b283fe2b7

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
17KB

MD5
8725d51097af51b2056386a3029369e4

SHA1
d05dc980227c426d04d7927ec1c457c8ab7a40c6

SHA256
c361c6c256e8d3bfa44b3e441cf925c4475eb012946b9443fcd73a0e0ea28dd5

SHA512
35fd7d55b527218e4382d026f40ea860bfced6c3f98e8c3fdbd0ec5697feae802b4c9d460fc5e3d1b96a2bcb084973776e3bab77ca95655c241cb35b283fe2b7

Download Submit
memory/1492-54-0x0000000074DB1000-0x0000000074DB3000-memory.dmp

Filesize
8KB

Download