upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
180s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe
Size

26KB
MD5

ffb010a500a91efad90a3e5d6301c386
SHA1

735b3a1ef2b83d505ac7d67bdf372f94ab224059
SHA256

0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e
SHA512

2ac5428801aaaad174108e92563f248b71dc41c4d41558e6a4bbfdbbde44c0b1996db35868a5be37fff3b271a2b1c7dfd142b16fd48b3f755e23f1dff18fbb1f
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/YBPmn:vNVrklvw

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
5092	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 5092	3880	0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe	79
PID 3880 wrote to memory of 5092	3880	0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe	79
PID 3880 wrote to memory of 5092	3880	0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe	79

C:\Users\Admin\AppData\Local\Temp\741\0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe
"C:\Users\Admin\AppData\Local\Temp\741\0fcd7d0fd1159576f45e8c78fce6cc52d172d1123843fd769916b0faf9948b9e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:5092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
c2e2a324d9dd430f9d6ddc98b72e99a7

SHA1
2d47963eaacf81ac69277164535aee2d54bf7a44

SHA256
fe8a66ddded09a9b689a8736ca045f76c16ae548a2e4f1719d70b4a0aad4cadf

SHA512
2317bca6491dcd30d008fcc03fb21095bbbf5d6f4cec93a8828e76e87b6674daab2561adb3988b25771fc62c986896cc6ec567ec398de6d1eaedd1abf63f3204

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
c2e2a324d9dd430f9d6ddc98b72e99a7

SHA1
2d47963eaacf81ac69277164535aee2d54bf7a44

SHA256
fe8a66ddded09a9b689a8736ca045f76c16ae548a2e4f1719d70b4a0aad4cadf

SHA512
2317bca6491dcd30d008fcc03fb21095bbbf5d6f4cec93a8828e76e87b6674daab2561adb3988b25771fc62c986896cc6ec567ec398de6d1eaedd1abf63f3204

Download Submit