upatre | a0eaab26f23b7b15963b01ac89ff3e5c79d90cab54f8d986e20b64cfab1da081

Analysis

max time kernel
154s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe
Size

130KB
MD5

55c6bc0fcf1273e5bd775d923a5af154
SHA1

3576a15b10efe2629f20163464dfdca1484e70d1
SHA256

a0eaab26f23b7b15963b01ac89ff3e5c79d90cab54f8d986e20b64cfab1da081
SHA512

ca27591219fd3a50308321e1f3f339ec26d75f7b6ec9dcd79a1c3d7b62545d84d90e708f89191740bfc1cd7819c25c50893142d28386fda645383a740260f058
SSDEEP

3072:tY9CUT62/UOVMgJsgJMgJogJwgJ0zqgJ01J3RgJ01JygJ01JK8gJ01JK2gJ01JKM:tY9C8QyFJlJFJRJZJqJyJ3CJyJbJyJWc

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3180	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3180	996	NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe	93
PID 996 wrote to memory of 3180	996	NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe	93
PID 996 wrote to memory of 3180	996	NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.55c6bc0fcf1273e5bd775d923a5af154_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
3e0a242f9156da377df609fed9762f5d

SHA1
b498331c49257c69be5f6f9cab03e7f368674e09

SHA256
0b1f16f68021d93cb0bef56d202878e20570c54b5f5304573f9ea7013e1cf9f3

SHA512
7136666357dd859f7755a809392cb11122ef5a85197f7575bfe9e593e44452724d8c66a8165c6990ba1a57ff0097efca70ab1e687326f7122931ebd402842d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
3e0a242f9156da377df609fed9762f5d

SHA1
b498331c49257c69be5f6f9cab03e7f368674e09

SHA256
0b1f16f68021d93cb0bef56d202878e20570c54b5f5304573f9ea7013e1cf9f3

SHA512
7136666357dd859f7755a809392cb11122ef5a85197f7575bfe9e593e44452724d8c66a8165c6990ba1a57ff0097efca70ab1e687326f7122931ebd402842d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
3e0a242f9156da377df609fed9762f5d

SHA1
b498331c49257c69be5f6f9cab03e7f368674e09

SHA256
0b1f16f68021d93cb0bef56d202878e20570c54b5f5304573f9ea7013e1cf9f3

SHA512
7136666357dd859f7755a809392cb11122ef5a85197f7575bfe9e593e44452724d8c66a8165c6990ba1a57ff0097efca70ab1e687326f7122931ebd402842d23

Download Submit
memory/996-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/996-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/996-2-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/996-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3180-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download