upatre | 8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7

Analysis

max time kernel
10s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2022 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe
Size

31KB
MD5

4c0b4f0c7c1e6d352827e744b32a9fb7
SHA1

044734d2153a2e2cb1a781533010dd432efc9082
SHA256

8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7
SHA512

933e960f3e7d5d376f77783ef1394791e450ec8b2231ed5cef2289d447e3e5121dc43f3fab5ac376f5df06a501db783267387d9f7e8089bd7cd3677beecdf3bd
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh9uT:GY9jw/dUT62rGdiUOWWrG

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

4184 szgfw.exe

pid	process
4184	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe

description	pid	process	target process
PID 4960 wrote to memory of 4184	4960	8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe	szgfw.exe
PID 4960 wrote to memory of 4184	4960	8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe	szgfw.exe
PID 4960 wrote to memory of 4184	4960	8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe
"C:\Users\Admin\AppData\Local\Temp\8a8d6d8ff7ce57a0717b8850bce82010e64e3160c1db958d70bfa6f5e6f420b7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:4184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
31KB

MD5
ddfc8a0ca9cf8c3d1cb59bea448a5bb4

SHA1
28edfefe39e9e6a7f61eb4af9ffda8ac375c3316

SHA256
adb779d234450ea0ce0f730c76f92c1275f076804e2aced76173afe862a4c4fd

SHA512
9c0404ef5e74050da79eba81d155d211678860dcf2ebde7e3f06c706fcf0724c8fd74af858d402b82063b7d3d303b0a53a0f3ca25d7f8acff3363d4bf4e545ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
31KB

MD5
ddfc8a0ca9cf8c3d1cb59bea448a5bb4

SHA1
28edfefe39e9e6a7f61eb4af9ffda8ac375c3316

SHA256
adb779d234450ea0ce0f730c76f92c1275f076804e2aced76173afe862a4c4fd

SHA512
9c0404ef5e74050da79eba81d155d211678860dcf2ebde7e3f06c706fcf0724c8fd74af858d402b82063b7d3d303b0a53a0f3ca25d7f8acff3363d4bf4e545ab

Download Submit
memory/4184-132-0x0000000000000000-mapping.dmp

Download