upatre | 5ec973014509f7f1cab5c08ec25d3a23bf2707db56b40a3daad4332d55e2f7ea

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff5f312e4a7b69523d1cf92459632531.exe
Size

41KB
MD5

ff5f312e4a7b69523d1cf92459632531
SHA1

50a7c9844bfdfa3b685fb9d6c2432ecaf9fea69f
SHA256

5ec973014509f7f1cab5c08ec25d3a23bf2707db56b40a3daad4332d55e2f7ea
SHA512

26d362673d80a76b239aa0650a2ab58308b66d4a67693eda61ce108664722cce31cd54ae6267e778a3974f9d5eba5680ae4918a391191e369a2986c986180f72
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rCBsPGTWikRyyjwyyyylyvyQ:GY9jw/dUT62rGdiUOWWrC6P6Tq

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2352	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1220	ff5f312e4a7b69523d1cf92459632531.exe
1220	ff5f312e4a7b69523d1cf92459632531.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2352	1220	ff5f312e4a7b69523d1cf92459632531.exe	28
PID 1220 wrote to memory of 2352	1220	ff5f312e4a7b69523d1cf92459632531.exe	28
PID 1220 wrote to memory of 2352	1220	ff5f312e4a7b69523d1cf92459632531.exe	28
PID 1220 wrote to memory of 2352	1220	ff5f312e4a7b69523d1cf92459632531.exe	28

C:\Users\Admin\AppData\Local\Temp\ff5f312e4a7b69523d1cf92459632531.exe
"C:\Users\Admin\AppData\Local\Temp\ff5f312e4a7b69523d1cf92459632531.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
41KB

MD5
1063fc5aa4d17e39de5807c1673b7077

SHA1
d3a61f73ea21a8211c69ba66166e90a06be4c1a3

SHA256
e8749fa6bef5ee2cd9ab09794513b1499973d8703013c76ffaa3ccb1b6df12e2

SHA512
141eb0a01c17833d44ac8e36f2ac37cc48e110a179cb742d5a0b5686dc13930ca3ffe4069fa33017da6bafcb56e6ce19e1a30976d0482805d64adb73fcd9ec20

Download Submit
memory/1220-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1220-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download