upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
149s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe
Size

23KB
MD5

85765f4bf09c9d1e5a2953a7a321bfba
SHA1

9be61852848b0fdfa22e95bc9a405fa08462141e
SHA256

446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0
SHA512

78abc04ab0251bf78b8c2ba635e557b346d8b9c659ee42317bae5b13a93384598b32f351adf174110c70788e011465558dfca595b8455f10ad3d486249339c4b
SSDEEP

384:6K+e9KfzQVByyyhi5uylXUylqylylmMXhgMyYYPh+NGGpIkv6FlOoAjIOmAMtb/l:v+qAUVByyyNylXUylqylylmMxgMyXANc

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
900	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1808	446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe
1808	446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 900	1808	446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe	27
PID 1808 wrote to memory of 900	1808	446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe	27
PID 1808 wrote to memory of 900	1808	446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe	27
PID 1808 wrote to memory of 900	1808	446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe	27

C:\Users\Admin\AppData\Local\Temp\741\446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe
"C:\Users\Admin\AppData\Local\Temp\741\446e91ba95353603670e19067b15414be954798066858381c5d148f475efb9b0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
23KB

MD5
615b25fde53203b8b42cfc295b6bb850

SHA1
178e7dac66749547d4135134835b1c0741982bac

SHA256
65ab8405f17980cab5b283ac503a4caae78e161fd44d4fd68335d95ccaa96220

SHA512
4544cb171574411cf36dd10d3dd0c7d0aebec8d8d6b79f78aa22d028334fd676f4430a2914b02c55be1f71fa00a111a646d6e9d2f8947d112de1ce2c5868f33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
23KB

MD5
615b25fde53203b8b42cfc295b6bb850

SHA1
178e7dac66749547d4135134835b1c0741982bac

SHA256
65ab8405f17980cab5b283ac503a4caae78e161fd44d4fd68335d95ccaa96220

SHA512
4544cb171574411cf36dd10d3dd0c7d0aebec8d8d6b79f78aa22d028334fd676f4430a2914b02c55be1f71fa00a111a646d6e9d2f8947d112de1ce2c5868f33b

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
23KB

MD5
615b25fde53203b8b42cfc295b6bb850

SHA1
178e7dac66749547d4135134835b1c0741982bac

SHA256
65ab8405f17980cab5b283ac503a4caae78e161fd44d4fd68335d95ccaa96220

SHA512
4544cb171574411cf36dd10d3dd0c7d0aebec8d8d6b79f78aa22d028334fd676f4430a2914b02c55be1f71fa00a111a646d6e9d2f8947d112de1ce2c5868f33b

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
23KB

MD5
615b25fde53203b8b42cfc295b6bb850

SHA1
178e7dac66749547d4135134835b1c0741982bac

SHA256
65ab8405f17980cab5b283ac503a4caae78e161fd44d4fd68335d95ccaa96220

SHA512
4544cb171574411cf36dd10d3dd0c7d0aebec8d8d6b79f78aa22d028334fd676f4430a2914b02c55be1f71fa00a111a646d6e9d2f8947d112de1ce2c5868f33b

Download Submit
memory/1808-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download