upatre | 9d4e630fdc6f53f103efd983f39c40fe0d358c96bacc23dead2525b7759e8c8b

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

635166366c57c2c30f491dbd64403e60_exe32.exe
Size

130KB
MD5

635166366c57c2c30f491dbd64403e60
SHA1

8688379c337327dd3e7844440bc8e40359857807
SHA256

9d4e630fdc6f53f103efd983f39c40fe0d358c96bacc23dead2525b7759e8c8b
SHA512

5f5f2cdec69d7b42879e05c8c2255dff6c47c5df81e39a5defdd21a9ae9358881c076a358d7c53436b4d5194198c754115cb0730d5226015a57a55d7acb546d2
SSDEEP

3072:tY9CUT62/UOVMgJsgJMgJogJwgJ0zqgJ01J3RgJ01JygJ01JK8gJ01JK2gJ01JKS:tY9C8QyFJlJFJRJZJqJyJ3CJyJbJyJWi

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
1532	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1900	635166366c57c2c30f491dbd64403e60_exe32.exe
1900	635166366c57c2c30f491dbd64403e60_exe32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1532	1900	635166366c57c2c30f491dbd64403e60_exe32.exe	28
PID 1900 wrote to memory of 1532	1900	635166366c57c2c30f491dbd64403e60_exe32.exe	28
PID 1900 wrote to memory of 1532	1900	635166366c57c2c30f491dbd64403e60_exe32.exe	28
PID 1900 wrote to memory of 1532	1900	635166366c57c2c30f491dbd64403e60_exe32.exe	28

C:\Users\Admin\AppData\Local\Temp\635166366c57c2c30f491dbd64403e60_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\635166366c57c2c30f491dbd64403e60_exe32.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
cc6e485380cbe71c63b55da86882f8e5

SHA1
a77358978c230ab169dbb5eb2181670d9b8099d2

SHA256
2dd02209a43c23d2ebc3299d1199417fdd1e638cc5ec99e9b61feb219d4ff1d7

SHA512
eb767362eb9b5216abbfb30915bf15342f4c2e533e65880c2c813af4ce3ce1645aa096f596fb1e4593455f7e5e74d97373010edb2bf3c74afa230b63d605c1d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
cc6e485380cbe71c63b55da86882f8e5

SHA1
a77358978c230ab169dbb5eb2181670d9b8099d2

SHA256
2dd02209a43c23d2ebc3299d1199417fdd1e638cc5ec99e9b61feb219d4ff1d7

SHA512
eb767362eb9b5216abbfb30915bf15342f4c2e533e65880c2c813af4ce3ce1645aa096f596fb1e4593455f7e5e74d97373010edb2bf3c74afa230b63d605c1d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
cc6e485380cbe71c63b55da86882f8e5

SHA1
a77358978c230ab169dbb5eb2181670d9b8099d2

SHA256
2dd02209a43c23d2ebc3299d1199417fdd1e638cc5ec99e9b61feb219d4ff1d7

SHA512
eb767362eb9b5216abbfb30915bf15342f4c2e533e65880c2c813af4ce3ce1645aa096f596fb1e4593455f7e5e74d97373010edb2bf3c74afa230b63d605c1d7

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
cc6e485380cbe71c63b55da86882f8e5

SHA1
a77358978c230ab169dbb5eb2181670d9b8099d2

SHA256
2dd02209a43c23d2ebc3299d1199417fdd1e638cc5ec99e9b61feb219d4ff1d7

SHA512
eb767362eb9b5216abbfb30915bf15342f4c2e533e65880c2c813af4ce3ce1645aa096f596fb1e4593455f7e5e74d97373010edb2bf3c74afa230b63d605c1d7

Download Submit
\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
130KB

MD5
cc6e485380cbe71c63b55da86882f8e5

SHA1
a77358978c230ab169dbb5eb2181670d9b8099d2

SHA256
2dd02209a43c23d2ebc3299d1199417fdd1e638cc5ec99e9b61feb219d4ff1d7

SHA512
eb767362eb9b5216abbfb30915bf15342f4c2e533e65880c2c813af4ce3ce1645aa096f596fb1e4593455f7e5e74d97373010edb2bf3c74afa230b63d605c1d7

Download Submit
memory/1532-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1900-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1900-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1900-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1900-10-0x0000000002FA0000-0x0000000002FC6000-memory.dmp

Filesize
152KB

Download