upatre | 65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12

Analysis

max time kernel
151s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe
Size 6KB
Sample240303-zmlxaagh74
SHA256 65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12
MD5 39f3b270d96214412b933ba8c0e65a40
SHA1 995546bcb86674e80ad3a63fdb519bf94d1e2267
SHA512 fed26887e1530c36c854e1922358cce8722af31bcb90739129852ade8a5972b3f0ee6d940349179a3dda33694deda526902d638714527cbf9c0b01ad45c73b6a
SSDEEP 96:Z0v4mUWKh9ctgC1RDDUnKymV44Shz1P+Xph3qK+fAS+Xuv2VfA:9mUWKs/DonKfzShoXph3q78evv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2992	4188	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe	97
PID 4188 wrote to memory of 2992	4188	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe	97
PID 4188 wrote to memory of 2992	4188	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe	97

C:\Users\Admin\AppData\Local\Temp\65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe
"C:\Users\Admin\AppData\Local\Temp\65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2660 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

szgfw.exe

Path C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Size 6KB
SHA256 d64fdee490c63b56468af0ad68194867160c927a683bb9e8e030cf6d7dcfde31
MD5 3f16b1491b64e256a282bcca0d505ed7
SHA1 862e8c32e842acff15a2f7fed469ae895a192aab
SHA512 6c2e05f310ef467b1eb3b7abbc95c890be61516dab36e69c447d318524effd6b76e212080994bd31fc787df4f94d311ae935a8b129dd869d1f25832898ed2aa8
SSDEEP 96:Z0v4mUWKh9ctgC1RDDUnKymV44Shz1P+Xph3qK+fAS+Xuv2Vf+xA:9mUWKs/DonKfzShoXph3q78ev1S
MD5 SHA1 SHA512 SSDEEP

Submit Download