upatre | 8b415185b3bb2144e6b0f6d6f936adc802c415f8ccbece0206e6bad0b9541be2

General

Target

a8890ad2a8832f94db0ef4255a97d8b8_JC.exe
Size

29KB
MD5

a8890ad2a8832f94db0ef4255a97d8b8
SHA1

a3cdd6dc2207f486349ef5153b915cccb61dc7cb
SHA256

8b415185b3bb2144e6b0f6d6f936adc802c415f8ccbece0206e6bad0b9541be2
SHA512

46e9180bd97ac2349b6fe0d6cc37b07bb2d177c064fe2bc87ad7bcbbe554730fe1391b439b28f17d2956bf9754db1c3263e4fe69ff8d11649eebe41dbc009ad1
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh9TdX/K:GY9jw/dUT62rGdiUOWWrk

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	a8890ad2a8832f94db0ef4255a97d8b8_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
968	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	320	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 968	4132	a8890ad2a8832f94db0ef4255a97d8b8_JC.exe	89
PID 4132 wrote to memory of 968	4132	a8890ad2a8832f94db0ef4255a97d8b8_JC.exe	89
PID 4132 wrote to memory of 968	4132	a8890ad2a8832f94db0ef4255a97d8b8_JC.exe	89

C:\Users\Admin\AppData\Local\Temp\a8890ad2a8832f94db0ef4255a97d8b8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a8890ad2a8832f94db0ef4255a97d8b8_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:968

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
3d87d2ec0bd212f774eedcc7614f4c74

SHA1
3aca69b5013a780cd3fdded95b82e176c8e36a38

SHA256
a6efda3e777c4ebc46dabe523d5529dd3d890e946c139027cddeb2be02b8f349

SHA512
bf682b950cf69ca1c6d274ea670587adbcb4859008bbadde429f074e4eecc4e43a1bb945b86507863385efc23709fb5db0121e4c95ae8123b25596f4c74e405f

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
30KB

MD5
f5716b2860d0e89d51d549289b9c8499

SHA1
f24139c94bb313c152a95edb8225150218e97dff

SHA256
031d90f2815310e6794c30441c86e220b1d1d4dfdb4db89b88f3d6c07acc1202

SHA512
89568e9f3d894b949ce2332edcbdfeccfa6084bae55051b03fca0fb06c9fb0dd07417655c42cadb4d43a0150b9af2c8d822641ccc0cbcb4299ac4118fe3c8287

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
30KB

MD5
f5716b2860d0e89d51d549289b9c8499

SHA1
f24139c94bb313c152a95edb8225150218e97dff

SHA256
031d90f2815310e6794c30441c86e220b1d1d4dfdb4db89b88f3d6c07acc1202

SHA512
89568e9f3d894b949ce2332edcbdfeccfa6084bae55051b03fca0fb06c9fb0dd07417655c42cadb4d43a0150b9af2c8d822641ccc0cbcb4299ac4118fe3c8287

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
30KB

MD5
f5716b2860d0e89d51d549289b9c8499

SHA1
f24139c94bb313c152a95edb8225150218e97dff

SHA256
031d90f2815310e6794c30441c86e220b1d1d4dfdb4db89b88f3d6c07acc1202

SHA512
89568e9f3d894b949ce2332edcbdfeccfa6084bae55051b03fca0fb06c9fb0dd07417655c42cadb4d43a0150b9af2c8d822641ccc0cbcb4299ac4118fe3c8287

Download Submit
memory/320-56-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-59-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-18-0x000001FA7BA40000-0x000001FA7BA50000-memory.dmp

Filesize
64KB

Download
memory/320-34-0x000001FA7BB40000-0x000001FA7BB50000-memory.dmp

Filesize
64KB

Download
memory/320-50-0x000001FA81100000-0x000001FA81101000-memory.dmp

Filesize
4KB

Download
memory/320-51-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-52-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-53-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-54-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-55-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-86-0x000001FA7FFA0000-0x000001FA7FFA1000-memory.dmp

Filesize
4KB

Download
memory/320-57-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-58-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-85-0x000001FA7FE90000-0x000001FA7FE91000-memory.dmp

Filesize
4KB

Download
memory/320-60-0x000001FA81130000-0x000001FA81131000-memory.dmp

Filesize
4KB

Download
memory/320-61-0x000001FA7FD50000-0x000001FA7FD51000-memory.dmp

Filesize
4KB

Download
memory/320-62-0x000001FA7FD40000-0x000001FA7FD41000-memory.dmp

Filesize
4KB

Download
memory/320-64-0x000001FA7FD50000-0x000001FA7FD51000-memory.dmp

Filesize
4KB

Download
memory/320-67-0x000001FA7FD40000-0x000001FA7FD41000-memory.dmp

Filesize
4KB

Download
memory/320-70-0x000001FA7FC80000-0x000001FA7FC81000-memory.dmp

Filesize
4KB

Download
memory/320-84-0x000001FA7FE90000-0x000001FA7FE91000-memory.dmp

Filesize
4KB

Download
memory/320-82-0x000001FA7FE80000-0x000001FA7FE81000-memory.dmp

Filesize
4KB

Download
memory/968-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4132-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4132-0-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing