upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
149s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe
Size

26KB
MD5

3d60b55eaa92942b95d904da07a74005
SHA1

4126fea63a44cf6e8822f504b6938ccde439fefc
SHA256

418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f
SHA512

b23d09c8648ea8e064b433c48938e036f5dfd42aec02deafb0a79c8b63013ee9fe09227878bd407c4dc0c6b719b0d06b72fde4c327c15adfd3d6fa5cea29038f
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/Ye5:vNVrklvI

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1264	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1632	418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe
1632	418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1264	1632	418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe	28
PID 1632 wrote to memory of 1264	1632	418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe	28
PID 1632 wrote to memory of 1264	1632	418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe	28
PID 1632 wrote to memory of 1264	1632	418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe	28

C:\Users\Admin\AppData\Local\Temp\741\418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe
"C:\Users\Admin\AppData\Local\Temp\741\418d865db53af34b9bb9288d4b0c6cc9d4c896fd43e97b3c3606852d0b8ff12f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
ab9ef8432c4a13d183e66c3c7c5c4485

SHA1
dbf7caf4bf8ea089e0fa8121594b18a990932377

SHA256
b0bfb3ef010a5980e111b6648c367178fc23e89111e859a65f9ebd39c2391781

SHA512
870e5bfadb3274facd64541d11e875d2b9c8be9cba96febfa47866f0cef5fee28a57939a5055950602d2f17caae31045e26b9846871ffe39692ee63167dcbe43

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
ab9ef8432c4a13d183e66c3c7c5c4485

SHA1
dbf7caf4bf8ea089e0fa8121594b18a990932377

SHA256
b0bfb3ef010a5980e111b6648c367178fc23e89111e859a65f9ebd39c2391781

SHA512
870e5bfadb3274facd64541d11e875d2b9c8be9cba96febfa47866f0cef5fee28a57939a5055950602d2f17caae31045e26b9846871ffe39692ee63167dcbe43

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
ab9ef8432c4a13d183e66c3c7c5c4485

SHA1
dbf7caf4bf8ea089e0fa8121594b18a990932377

SHA256
b0bfb3ef010a5980e111b6648c367178fc23e89111e859a65f9ebd39c2391781

SHA512
870e5bfadb3274facd64541d11e875d2b9c8be9cba96febfa47866f0cef5fee28a57939a5055950602d2f17caae31045e26b9846871ffe39692ee63167dcbe43

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
ab9ef8432c4a13d183e66c3c7c5c4485

SHA1
dbf7caf4bf8ea089e0fa8121594b18a990932377

SHA256
b0bfb3ef010a5980e111b6648c367178fc23e89111e859a65f9ebd39c2391781

SHA512
870e5bfadb3274facd64541d11e875d2b9c8be9cba96febfa47866f0cef5fee28a57939a5055950602d2f17caae31045e26b9846871ffe39692ee63167dcbe43

Download Submit
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download