upatre | 65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12

Analysis

max time kernel
151s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe
Size

6KB
MD5

39f3b270d96214412b933ba8c0e65a40
SHA1

995546bcb86674e80ad3a63fdb519bf94d1e2267
SHA256

65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12
SHA512

fed26887e1530c36c854e1922358cce8722af31bcb90739129852ade8a5972b3f0ee6d940349179a3dda33694deda526902d638714527cbf9c0b01ad45c73b6a
SSDEEP

96:Z0v4mUWKh9ctgC1RDDUnKymV44Shz1P+Xph3qK+fAS+Xuv2VfA:9mUWKs/DonKfzShoXph3q78evv

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2992	4188	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe	97
PID 4188 wrote to memory of 2992	4188	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe	97
PID 4188 wrote to memory of 2992	4188	65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe	97

C:\Users\Admin\AppData\Local\Temp\65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe
"C:\Users\Admin\AppData\Local\Temp\65cb47e63228b570a7f8846157af85813c4c9c020f66fa4a581253af4df4fc12.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2660 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
6KB

MD5
3f16b1491b64e256a282bcca0d505ed7

SHA1
862e8c32e842acff15a2f7fed469ae895a192aab

SHA256
d64fdee490c63b56468af0ad68194867160c927a683bb9e8e030cf6d7dcfde31

SHA512
6c2e05f310ef467b1eb3b7abbc95c890be61516dab36e69c447d318524effd6b76e212080994bd31fc787df4f94d311ae935a8b129dd869d1f25832898ed2aa8

Download Submit