upatre | f27b1ada909bab6e34372ab42083023aa92ca2de72ec88707226086008392725

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d398d277199a10b170a28600631f2054.exe
Size 12KB
Sample231220-slfkjsfbh6
SHA256 f27b1ada909bab6e34372ab42083023aa92ca2de72ec88707226086008392725
MD5 d398d277199a10b170a28600631f2054
SHA1 3a0754bc02c3360ab0a030964042101e784792b6
SHA512 51876e81f9a731f87e65235fb934da092ef16bfe8d60ef6f85566a43d7bc13dc2e015673817ee93e9bbbe05a3720a94072b441f90e66ff48f52bca00c1c35d4d
SSDEEP 384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7jElym6yyylaDyQ:v+dAURFxna4QAPQlYg7jElym6yyylaDH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	d398d277199a10b170a28600631f2054.exe

Executes dropped EXE 1 IoCs

pid	Process
228	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 228	4624	d398d277199a10b170a28600631f2054.exe	89
PID 4624 wrote to memory of 228	4624	d398d277199a10b170a28600631f2054.exe	89
PID 4624 wrote to memory of 228	4624	d398d277199a10b170a28600631f2054.exe	89

C:\Users\Admin\AppData\Local\Temp\d398d277199a10b170a28600631f2054.exe
"C:\Users\Admin\AppData\Local\Temp\d398d277199a10b170a28600631f2054.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szgfw.exe

Path C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Size 12KB
SHA256 c673d2527b6b94ca5afc938f0ef739bf3dee0957ae33f31f432997adcf742c3b
MD5 58dbf7128ffe92013072464c092be51a
SHA1 74bec8cd1b5122ef57addb9a623067066ce9062c
SHA512 603c7164d62c8d87949eb59746c99cde521ff15e2a803bf242db2b6d56c207ead9f0030aaeb8bc7aa70e12f48f826fd6a6f21f87e9ec1314d0d1a9ffdd09f64f
SSDEEP 384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7jElym6yyylaDy64:v+dAURFxna4QAPQlYg7jElym6yyylaD6
MD5 SHA1 SHA512 SSDEEP

Submit Download