upatre | f27b1ada909bab6e34372ab42083023aa92ca2de72ec88707226086008392725

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d398d277199a10b170a28600631f2054.exe
Size

12KB
MD5

d398d277199a10b170a28600631f2054
SHA1

3a0754bc02c3360ab0a030964042101e784792b6
SHA256

f27b1ada909bab6e34372ab42083023aa92ca2de72ec88707226086008392725
SHA512

51876e81f9a731f87e65235fb934da092ef16bfe8d60ef6f85566a43d7bc13dc2e015673817ee93e9bbbe05a3720a94072b441f90e66ff48f52bca00c1c35d4d
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7jElym6yyylaDyQ:v+dAURFxna4QAPQlYg7jElym6yyylaDH

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2088	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2264	d398d277199a10b170a28600631f2054.exe
2264	d398d277199a10b170a28600631f2054.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2088	2264	d398d277199a10b170a28600631f2054.exe	28
PID 2264 wrote to memory of 2088	2264	d398d277199a10b170a28600631f2054.exe	28
PID 2264 wrote to memory of 2088	2264	d398d277199a10b170a28600631f2054.exe	28
PID 2264 wrote to memory of 2088	2264	d398d277199a10b170a28600631f2054.exe	28

C:\Users\Admin\AppData\Local\Temp\d398d277199a10b170a28600631f2054.exe
"C:\Users\Admin\AppData\Local\Temp\d398d277199a10b170a28600631f2054.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
12KB

MD5
58dbf7128ffe92013072464c092be51a

SHA1
74bec8cd1b5122ef57addb9a623067066ce9062c

SHA256
c673d2527b6b94ca5afc938f0ef739bf3dee0957ae33f31f432997adcf742c3b

SHA512
603c7164d62c8d87949eb59746c99cde521ff15e2a803bf242db2b6d56c207ead9f0030aaeb8bc7aa70e12f48f826fd6a6f21f87e9ec1314d0d1a9ffdd09f64f

Download Submit