upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
170s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe
Size

25KB
MD5

167baa19eaff29755629107ef03839c8
SHA1

d165b7f381f484e6a2b32f8dd8b457705cef8649
SHA256

7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360
SHA512

fb1b68d560389f7fbf1f39415a66a70218e612fa4b99b94eab87abc118068b2cecf60d935d4dd84a0e63f9bfe4e2f651f6316969ce4e2b47548518688dc9bbe8
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/iXQ:vNVrklvo

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1892	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1376	7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe
1376	7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1892	1376	7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe	28
PID 1376 wrote to memory of 1892	1376	7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe	28
PID 1376 wrote to memory of 1892	1376	7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe	28
PID 1376 wrote to memory of 1892	1376	7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe	28

C:\Users\Admin\AppData\Local\Temp\741\7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe
"C:\Users\Admin\AppData\Local\Temp\741\7a36e12e66ffc2747da6490773ab467ec1bbd169403807d7f12af90a9f5fe360.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
317b5d4f30a8a7e6f372bee892c59162

SHA1
1222bcb8c867f0e4e89065b800b155e060327c3f

SHA256
1de1f763b0cdd84f2b11ddf880f9bbdf462540a63e3f007787a3d5667fe52292

SHA512
7f2375a8da6d624825a1c54cadcd9465bbe676a8e0983ac0fd6700bf9f6025bf3ab1087ac5fda1997e0de6c6bd6293eb0525b4b93fc148f41f741f254cf34f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
317b5d4f30a8a7e6f372bee892c59162

SHA1
1222bcb8c867f0e4e89065b800b155e060327c3f

SHA256
1de1f763b0cdd84f2b11ddf880f9bbdf462540a63e3f007787a3d5667fe52292

SHA512
7f2375a8da6d624825a1c54cadcd9465bbe676a8e0983ac0fd6700bf9f6025bf3ab1087ac5fda1997e0de6c6bd6293eb0525b4b93fc148f41f741f254cf34f67

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
317b5d4f30a8a7e6f372bee892c59162

SHA1
1222bcb8c867f0e4e89065b800b155e060327c3f

SHA256
1de1f763b0cdd84f2b11ddf880f9bbdf462540a63e3f007787a3d5667fe52292

SHA512
7f2375a8da6d624825a1c54cadcd9465bbe676a8e0983ac0fd6700bf9f6025bf3ab1087ac5fda1997e0de6c6bd6293eb0525b4b93fc148f41f741f254cf34f67

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
317b5d4f30a8a7e6f372bee892c59162

SHA1
1222bcb8c867f0e4e89065b800b155e060327c3f

SHA256
1de1f763b0cdd84f2b11ddf880f9bbdf462540a63e3f007787a3d5667fe52292

SHA512
7f2375a8da6d624825a1c54cadcd9465bbe676a8e0983ac0fd6700bf9f6025bf3ab1087ac5fda1997e0de6c6bd6293eb0525b4b93fc148f41f741f254cf34f67

Download Submit
memory/1376-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download