upatre | 0f8435b29e045cd3b2c0429dcdc16b6986369dd51a5c72e6d1866c74cad401d1

Analysis

max time kernel
153s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2022, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.exe
Size 17KB
Sample220715-trcaracbb3
SHA256 0f8435b29e045cd3b2c0429dcdc16b6986369dd51a5c72e6d1866c74cad401d1
MD5 1f5b84262800540708145eb95744bb10
SHA1 59014ed1a05f10037dd995490b98276ee809e00e
SHA512 0b7f6cbd348aa8ae5f75f766c05a88806b3a8e0e33126f621c7358fa075fd02973ede5d70b21f06078d98de6d82761a8ce9ce299b3e701cf4cefaf5e1c98cdd5
MD5 SHA1 SHA512

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
4228	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	virussign.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4228	2304	virussign.exe	78
PID 2304 wrote to memory of 4228	2304	virussign.exe	78
PID 2304 wrote to memory of 4228	2304	virussign.exe	78

C:\Users\Admin\AppData\Local\Temp\virussign.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szgfw.exe

Path C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Size 17KB
SHA256 c361c6c256e8d3bfa44b3e441cf925c4475eb012946b9443fcd73a0e0ea28dd5
MD5 8725d51097af51b2056386a3029369e4
SHA1 d05dc980227c426d04d7927ec1c457c8ab7a40c6
SHA512 35fd7d55b527218e4382d026f40ea860bfced6c3f98e8c3fdbd0ec5697feae802b4c9d460fc5e3d1b96a2bcb084973776e3bab77ca95655c241cb35b283fe2b7
SSDEEP 384:6K+e9KfzQVByyyhi5uylXUylqylylmMXhgMyYYPh+NGGpIkv6FlOoAj9:v+qAUVByyyNylXUylqylylmMxgMyXANl
MD5 SHA1 SHA512 SSDEEP

Submit Download