upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe
Size

25KB
MD5

8af643bb33cbbfcc2031236fa26fecba
SHA1

79552a8ef4d7b32fa343ef5b2695d3b2b0956be8
SHA256

8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48
SHA512

2d069b8008e2645ce422e350037acd5a555344c61ee358073ff69caf7ec62fac46f3cb2cdc8240283b3bda1152d619642862a448cb362239842a4a541ee88480
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/Yk:vNVrklv6

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1888	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1976	8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe
1976	8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1888	1976	8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe	28
PID 1976 wrote to memory of 1888	1976	8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe	28
PID 1976 wrote to memory of 1888	1976	8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe	28
PID 1976 wrote to memory of 1888	1976	8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe	28

C:\Users\Admin\AppData\Local\Temp\741\8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe
"C:\Users\Admin\AppData\Local\Temp\741\8cab92d90d6cc9c39195b5fec4de84acccc10db810f8a2184a8b9259e9afca48.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
a8dc2b8521d5b128c65a3e86739e9ebd

SHA1
884315e2da3d31566ae3a122e0145375ddb82a57

SHA256
0a5053414938129d9a429e3f1602f6e0cd95b05a617f773b521010b10db338b8

SHA512
299c9d67dbe24905c7ba65f54000b0b8baf9c36336dd7a767e8ecd844ff4a387123110f3735482684672ec4ac442e5caf253fbabeb1f2a5ff549193b56bb4330

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
a8dc2b8521d5b128c65a3e86739e9ebd

SHA1
884315e2da3d31566ae3a122e0145375ddb82a57

SHA256
0a5053414938129d9a429e3f1602f6e0cd95b05a617f773b521010b10db338b8

SHA512
299c9d67dbe24905c7ba65f54000b0b8baf9c36336dd7a767e8ecd844ff4a387123110f3735482684672ec4ac442e5caf253fbabeb1f2a5ff549193b56bb4330

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
a8dc2b8521d5b128c65a3e86739e9ebd

SHA1
884315e2da3d31566ae3a122e0145375ddb82a57

SHA256
0a5053414938129d9a429e3f1602f6e0cd95b05a617f773b521010b10db338b8

SHA512
299c9d67dbe24905c7ba65f54000b0b8baf9c36336dd7a767e8ecd844ff4a387123110f3735482684672ec4ac442e5caf253fbabeb1f2a5ff549193b56bb4330

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
a8dc2b8521d5b128c65a3e86739e9ebd

SHA1
884315e2da3d31566ae3a122e0145375ddb82a57

SHA256
0a5053414938129d9a429e3f1602f6e0cd95b05a617f773b521010b10db338b8

SHA512
299c9d67dbe24905c7ba65f54000b0b8baf9c36336dd7a767e8ecd844ff4a387123110f3735482684672ec4ac442e5caf253fbabeb1f2a5ff549193b56bb4330

Download Submit
memory/1976-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download