upatre | ed4053d15783e6fcb22313311ba6ee9aa6973111e1563956921c44eb1cc88210

Analysis

max time kernel
147s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1338e5b87bd562b59e58164cbd14e41b.exe
Size

11KB
MD5

1338e5b87bd562b59e58164cbd14e41b
SHA1

2cdd38d7fb70dfc1deaf025109dea5b170d0e964
SHA256

ed4053d15783e6fcb22313311ba6ee9aa6973111e1563956921c44eb1cc88210
SHA512

fdc0bea699f0a105cf01b14ae0849a62f006c871d42b1d15bc6fa7bddb63bff6d9eb044065591ab361eb81a2ef2b0a5440e6ff80144861d0ce2bce1a1aa60852
SSDEEP

192:9mUWKs/RnKfzShH/JFxRmyja4QhiP7UlZSyGjpjWDwyl1XN+gB7Q:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKwj

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	1338e5b87bd562b59e58164cbd14e41b.exe

Executes dropped EXE 1 IoCs

pid	Process
3424	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3424	2292	1338e5b87bd562b59e58164cbd14e41b.exe	22
PID 2292 wrote to memory of 3424	2292	1338e5b87bd562b59e58164cbd14e41b.exe	22
PID 2292 wrote to memory of 3424	2292	1338e5b87bd562b59e58164cbd14e41b.exe	22

C:\Users\Admin\AppData\Local\Temp\1338e5b87bd562b59e58164cbd14e41b.exe
"C:\Users\Admin\AppData\Local\Temp\1338e5b87bd562b59e58164cbd14e41b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
11KB

MD5
ae0672ea153cb5db873a5b5c81ff34a0

SHA1
87010b8a730a5b261f1c257bb93d15409589a53f

SHA256
e2ea01f297e75c6aa1d29bce1603c305f732916fade4a91a16cd06d22dd8a9b5

SHA512
adc45dd076abbec0282448a2d9e8807568cdb6af6dfaa483b43035b2e2cac15b39cb6647cead1fc5fd512edd696f6f121de7f32ca67ab99d6617b7c200d1ee97

Download Submit