upatre | 9e17c409277a6de1d77b824b10e8922c699e5b91ec5d75711bcd4ef8244189a3

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe
Size

94KB
MD5

ea7e0f18e1fd91c5e7c575197a747e70
SHA1

d5e00f4b1b0401ffe7cd5799e53c3f8a691a7a30
SHA256

9e17c409277a6de1d77b824b10e8922c699e5b91ec5d75711bcd4ef8244189a3
SHA512

65a37fc03f79aa2d0ee3381e79cc8cb0106617155e970a13b21e794c2d06d9e2c72a282006461f9b5bc591cda08ee7279b761d187541f97c2b45da0ec98976ba
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUI:iY9CUT62/UOVMu8i8N898b8XN8X98XGD

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2692 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe

pid process

2988 NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe
2988 NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2692	szgfw.exe

pid	process
2988	NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe
2988	NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe

description	pid	process	target process
PID 2988 wrote to memory of 2692	2988	NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe	szgfw.exe
PID 2988 wrote to memory of 2692	2988	NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe	szgfw.exe
PID 2988 wrote to memory of 2692	2988	NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe	szgfw.exe
PID 2988 wrote to memory of 2692	2988	NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ea7e0f18e1fd91c5e7c575197a747e70_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2692

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
94KB

MD5
d6202f2820356b795ac1146cb12765ed

SHA1
ca187ab5e021f45650338935ce7ef67d76395ea5

SHA256
f18db19c60cca398f385b3638b8ebff8eb5b0cd3960b81de13c5efa95467960a

SHA512
3bde748aca905fbee18f3ae71e0dcf80b78463b6dc582690f52fdf1703721ebb29cb3c9057ab7f27e16a87fe75fd2ac6f0c52e0b904e952d42126ce9acee6050

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
94KB

MD5
d6202f2820356b795ac1146cb12765ed

SHA1
ca187ab5e021f45650338935ce7ef67d76395ea5

SHA256
f18db19c60cca398f385b3638b8ebff8eb5b0cd3960b81de13c5efa95467960a

SHA512
3bde748aca905fbee18f3ae71e0dcf80b78463b6dc582690f52fdf1703721ebb29cb3c9057ab7f27e16a87fe75fd2ac6f0c52e0b904e952d42126ce9acee6050

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
94KB

MD5
d6202f2820356b795ac1146cb12765ed

SHA1
ca187ab5e021f45650338935ce7ef67d76395ea5

SHA256
f18db19c60cca398f385b3638b8ebff8eb5b0cd3960b81de13c5efa95467960a

SHA512
3bde748aca905fbee18f3ae71e0dcf80b78463b6dc582690f52fdf1703721ebb29cb3c9057ab7f27e16a87fe75fd2ac6f0c52e0b904e952d42126ce9acee6050

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
94KB

MD5
d6202f2820356b795ac1146cb12765ed

SHA1
ca187ab5e021f45650338935ce7ef67d76395ea5

SHA256
f18db19c60cca398f385b3638b8ebff8eb5b0cd3960b81de13c5efa95467960a

SHA512
3bde748aca905fbee18f3ae71e0dcf80b78463b6dc582690f52fdf1703721ebb29cb3c9057ab7f27e16a87fe75fd2ac6f0c52e0b904e952d42126ce9acee6050

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
94KB

MD5
d6202f2820356b795ac1146cb12765ed

SHA1
ca187ab5e021f45650338935ce7ef67d76395ea5

SHA256
f18db19c60cca398f385b3638b8ebff8eb5b0cd3960b81de13c5efa95467960a

SHA512
3bde748aca905fbee18f3ae71e0dcf80b78463b6dc582690f52fdf1703721ebb29cb3c9057ab7f27e16a87fe75fd2ac6f0c52e0b904e952d42126ce9acee6050

Download Submit
memory/2988-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2988-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download