upatre | 19e9b4524bbab365e60b1e0f75cb73ffee4caa96f57f1033e5701c96474bc65e

Analysis

max time kernel
182s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741/1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe
Size

25KB
MD5

8aa48cc0baf310f26030378457a58edf
SHA1

a87558b1381b3f62e3544b055d13fea5bd2c4e1d
SHA256

1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e
SHA512

80deec5d4954cd0e13c332da183ee54cb5e4f29f0d3afc1dfacd6e0a5096782af171060926510f201f1b7a8979af87c4f41747b7c8917b2308b9de937d63579d
SSDEEP

768:v+qAUVByyyNylXUylqylylmMxgMyXAN5IkSFlOxXmkewtWVJ/YBPmr:vNVrklvU

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
4708	szgfw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4708	4896	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	80
PID 4896 wrote to memory of 4708	4896	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	80
PID 4896 wrote to memory of 4708	4896	1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe	80

C:\Users\Admin\AppData\Local\Temp\741\1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe
"C:\Users\Admin\AppData\Local\Temp\741\1562f8b733bb67cd16278bc613047158edf2c56274cfa8b0fc0d1a31ed0a135e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
5a2614d2414b4760a863eabd34b1c758

SHA1
e9acd49f5db983bb2275cde3676432f1ac5c8c27

SHA256
423520b93ff0a9b7654e3e104ffa7123451e1de327fd267b1cb7eaf2e10af260

SHA512
6cc89eb740646ca0b9415e8ce6464882a7e978c5227d95625765db5855ba7ba49298cc216569e880214f4aa7574ee707fdbfc1f862f3ac387f33daa20ef4fc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
26KB

MD5
5a2614d2414b4760a863eabd34b1c758

SHA1
e9acd49f5db983bb2275cde3676432f1ac5c8c27

SHA256
423520b93ff0a9b7654e3e104ffa7123451e1de327fd267b1cb7eaf2e10af260

SHA512
6cc89eb740646ca0b9415e8ce6464882a7e978c5227d95625765db5855ba7ba49298cc216569e880214f4aa7574ee707fdbfc1f862f3ac387f33daa20ef4fc2c

Download Submit