upatre | f27b1ada909bab6e34372ab42083023aa92ca2de72ec88707226086008392725

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d398d277199a10b170a28600631f2054.exe
Size

12KB
MD5

d398d277199a10b170a28600631f2054
SHA1

3a0754bc02c3360ab0a030964042101e784792b6
SHA256

f27b1ada909bab6e34372ab42083023aa92ca2de72ec88707226086008392725
SHA512

51876e81f9a731f87e65235fb934da092ef16bfe8d60ef6f85566a43d7bc13dc2e015673817ee93e9bbbe05a3720a94072b441f90e66ff48f52bca00c1c35d4d
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7jElym6yyylaDyQ:v+dAURFxna4QAPQlYg7jElym6yyylaDH

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	d398d277199a10b170a28600631f2054.exe

Executes dropped EXE 1 IoCs

pid	Process
228	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 228	4624	d398d277199a10b170a28600631f2054.exe	89
PID 4624 wrote to memory of 228	4624	d398d277199a10b170a28600631f2054.exe	89
PID 4624 wrote to memory of 228	4624	d398d277199a10b170a28600631f2054.exe	89

C:\Users\Admin\AppData\Local\Temp\d398d277199a10b170a28600631f2054.exe
"C:\Users\Admin\AppData\Local\Temp\d398d277199a10b170a28600631f2054.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
12KB

MD5
58dbf7128ffe92013072464c092be51a

SHA1
74bec8cd1b5122ef57addb9a623067066ce9062c

SHA256
c673d2527b6b94ca5afc938f0ef739bf3dee0957ae33f31f432997adcf742c3b

SHA512
603c7164d62c8d87949eb59746c99cde521ff15e2a803bf242db2b6d56c207ead9f0030aaeb8bc7aa70e12f48f826fd6a6f21f87e9ec1314d0d1a9ffdd09f64f

Download Submit