upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
163s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe
Size

23KB
MD5

a086424a841b49e823c7780f1a780d13
SHA1

d265cbf9ed4f836310cbba96cbfea5af33f4d3b0
SHA256

7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29
SHA512

7543149208cbf81fc258bb3533c88aca5ac38f69ff4418bb3b56a1bdde559a44de48738b4bf9991c8c9564b7648c31a13ae3f2242499cd625f5332a2bddc9c3c
SSDEEP

384:6K+e9KfzQVByyyhi5uylXUylqylylmMXhgMyYYPh+NGGpIkv6FlOoAjIOmAMtb/i:v+qAUVByyyNylXUylqylylmMxgMyXANX

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1992	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 1992	4388	7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe	79
PID 4388 wrote to memory of 1992	4388	7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe	79
PID 4388 wrote to memory of 1992	4388	7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe	79

C:\Users\Admin\AppData\Local\Temp\741\7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe
"C:\Users\Admin\AppData\Local\Temp\741\7349b45e0b92c416000f0c0db2c495d547eb538be3799915883c9da3ceb31f29.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
24KB

MD5
b14505dd054913693c71fb6ada0477e8

SHA1
422958474cfcb34e22f25b8e3d97e7a6f05fcff2

SHA256
9500d4f034190b2016a3698771a9bbbe6bf871b5ab6865d21dd78893ef566078

SHA512
72d4a40f2319f95aeca1f1bedd64703d98ffeab1979bf5b087387cb5d787ec1daf948954810e7d7e5ce87c841e400da350c4b93ef4458531e516366566cd3999

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
24KB

MD5
b14505dd054913693c71fb6ada0477e8

SHA1
422958474cfcb34e22f25b8e3d97e7a6f05fcff2

SHA256
9500d4f034190b2016a3698771a9bbbe6bf871b5ab6865d21dd78893ef566078

SHA512
72d4a40f2319f95aeca1f1bedd64703d98ffeab1979bf5b087387cb5d787ec1daf948954810e7d7e5ce87c841e400da350c4b93ef4458531e516366566cd3999

Download Submit