upatre | 5ac0abe02ecffa8ce1f13d93ce8470f26b13580d1f563e1e8fabe2c2e4ca1d95

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e067b285521bab6aa393267a0842d663.exe
Size

12KB
MD5

e067b285521bab6aa393267a0842d663
SHA1

7dc5751725e06ccd19c2c8731ab30398744dbaca
SHA256

5ac0abe02ecffa8ce1f13d93ce8470f26b13580d1f563e1e8fabe2c2e4ca1d95
SHA512

a9cb63f748979324da3cd65b297c22f99989a978fe9a0a2b714947ea3d9076ba9db790a9787822b212259070e8ce0bb17fc4d29df0c4adf4619417366f5d9934
SSDEEP

384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKhYjlyyuA0hyyIsap:v+dAURFxna4QAPQlYghmlyyuA0hyyIz

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	e067b285521bab6aa393267a0842d663.exe

Executes dropped EXE 1 IoCs

pid	Process
1228	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1228	2896	e067b285521bab6aa393267a0842d663.exe	90
PID 2896 wrote to memory of 1228	2896	e067b285521bab6aa393267a0842d663.exe	90
PID 2896 wrote to memory of 1228	2896	e067b285521bab6aa393267a0842d663.exe	90

C:\Users\Admin\AppData\Local\Temp\e067b285521bab6aa393267a0842d663.exe
"C:\Users\Admin\AppData\Local\Temp\e067b285521bab6aa393267a0842d663.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
12KB

MD5
a6c1e059d349b8341f9528bc5ff173cc

SHA1
a69290eb0eb1d9bc4a443cbe806910ff3e8af015

SHA256
cad69fe9676b20d43c1b32dcc99d59b967e016466d9fe2dbe94a90e2205e5d05

SHA512
aed7a6286594a31781e3f236cf9e806de7e61c7b4b21e0e8dd7df19fb61e6cfe6289e49f74a8146e646045df037f4f5e84422d538133bccd97bed81d49719add

Download Submit