upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
170s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe
Size

25KB
MD5

706636408b4b02b450366f089ee93a88
SHA1

d4d25b59fd7e176b55b092a55ee78fb3ed947d9f
SHA256

8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e
SHA512

1c90f72e2c9cc45b6bea95f432eba87d2f2b1e3df08cd7ba2ce5eb0dd7181e1b70df5f0ffd080beb9ab353002a1baf632aab30d3f82134845bcc2071c4ccee05
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/YU:vNVrklvK

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
996	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1832	8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe
1832	8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 996	1832	8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe	28
PID 1832 wrote to memory of 996	1832	8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe	28
PID 1832 wrote to memory of 996	1832	8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe	28
PID 1832 wrote to memory of 996	1832	8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe	28

C:\Users\Admin\AppData\Local\Temp\741\8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe
"C:\Users\Admin\AppData\Local\Temp\741\8d983d24f9146a671e1e17ef2bd31708b7c207c30c14696501801ee521bf0a4e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
5e2c692962b2966df40022ff101d9d21

SHA1
29817a89127332e5cdd2b573a05abf2010b7b3b8

SHA256
733befdae2fba1e26af0274cf40cdb9198206aa0c2efe5d75c2f3d4de8c3c33f

SHA512
77d3d9f33bde270eb4b9f35cf7a83360157490565507b7e98997cbc3dbe46373d07e2464c1dc2a588cd025a3118b4d8551f870000a3276fca5e7339ddfb7c165

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
5e2c692962b2966df40022ff101d9d21

SHA1
29817a89127332e5cdd2b573a05abf2010b7b3b8

SHA256
733befdae2fba1e26af0274cf40cdb9198206aa0c2efe5d75c2f3d4de8c3c33f

SHA512
77d3d9f33bde270eb4b9f35cf7a83360157490565507b7e98997cbc3dbe46373d07e2464c1dc2a588cd025a3118b4d8551f870000a3276fca5e7339ddfb7c165

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
5e2c692962b2966df40022ff101d9d21

SHA1
29817a89127332e5cdd2b573a05abf2010b7b3b8

SHA256
733befdae2fba1e26af0274cf40cdb9198206aa0c2efe5d75c2f3d4de8c3c33f

SHA512
77d3d9f33bde270eb4b9f35cf7a83360157490565507b7e98997cbc3dbe46373d07e2464c1dc2a588cd025a3118b4d8551f870000a3276fca5e7339ddfb7c165

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
25KB

MD5
5e2c692962b2966df40022ff101d9d21

SHA1
29817a89127332e5cdd2b573a05abf2010b7b3b8

SHA256
733befdae2fba1e26af0274cf40cdb9198206aa0c2efe5d75c2f3d4de8c3c33f

SHA512
77d3d9f33bde270eb4b9f35cf7a83360157490565507b7e98997cbc3dbe46373d07e2464c1dc2a588cd025a3118b4d8551f870000a3276fca5e7339ddfb7c165

Download Submit
memory/1832-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download