upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe
Size

25KB
MD5

8aa48cc0baf310f26030378457a58edf
SHA1

a87558b1381b3f62e3544b055d13fea5bd2c4e1d
SHA256

1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e
SHA512

80deec5d4954cd0e13c332da183ee54cb5e4f29f0d3afc1dfacd6e0a5096782af171060926510f201f1b7a8979af87c4f41747b7c8917b2308b9de937d63579d
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/YBPmr:vNVrklvU

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2000	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1100	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe
1100	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2000	1100	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	28
PID 1100 wrote to memory of 2000	1100	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	28
PID 1100 wrote to memory of 2000	1100	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	28
PID 1100 wrote to memory of 2000	1100	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	28

C:\Users\Admin\AppData\Local\Temp\741\1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe
"C:\Users\Admin\AppData\Local\Temp\741\1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
5a2614d2414b4760a863eabd34b1c758

SHA1
e9acd49f5db983bb2275cde3676432f1ac5c8c27

SHA256
423520b93ff0a9b7654e3e104ffa7123451e1de327fd267b1cb7eaf2e10af260

SHA512
6cc89eb740646ca0b9415e8ce6464882a7e978c5227d95625765db5855ba7ba49298cc216569e880214f4aa7574ee707fdbfc1f862f3ac387f33daa20ef4fc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
5a2614d2414b4760a863eabd34b1c758

SHA1
e9acd49f5db983bb2275cde3676432f1ac5c8c27

SHA256
423520b93ff0a9b7654e3e104ffa7123451e1de327fd267b1cb7eaf2e10af260

SHA512
6cc89eb740646ca0b9415e8ce6464882a7e978c5227d95625765db5855ba7ba49298cc216569e880214f4aa7574ee707fdbfc1f862f3ac387f33daa20ef4fc2c

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
5a2614d2414b4760a863eabd34b1c758

SHA1
e9acd49f5db983bb2275cde3676432f1ac5c8c27

SHA256
423520b93ff0a9b7654e3e104ffa7123451e1de327fd267b1cb7eaf2e10af260

SHA512
6cc89eb740646ca0b9415e8ce6464882a7e978c5227d95625765db5855ba7ba49298cc216569e880214f4aa7574ee707fdbfc1f862f3ac387f33daa20ef4fc2c

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
5a2614d2414b4760a863eabd34b1c758

SHA1
e9acd49f5db983bb2275cde3676432f1ac5c8c27

SHA256
423520b93ff0a9b7654e3e104ffa7123451e1de327fd267b1cb7eaf2e10af260

SHA512
6cc89eb740646ca0b9415e8ce6464882a7e978c5227d95625765db5855ba7ba49298cc216569e880214f4aa7574ee707fdbfc1f862f3ac387f33daa20ef4fc2c

Download Submit
memory/1100-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download