upatre | 8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe
Size

71KB
MD5

53353165d38877ba3d3e56828b7275b2
SHA1

e96e5242d4c0f224365d4f8592f200bad4ac2474
SHA256

8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850
SHA512

8c03615d0d0c5740ce5069706c19e44432dd745a8977c2bc318b3f4f2b83ee321c89cddce7471204af956ef4f9f74fc1708b5cc9c856e3d9f3aeb69e55f8d477
SSDEEP

1536:vCWDKUlsCZD1mh8txVQnlRIFYK4Ncp1wDLqkw:6hjTm

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe

Executes dropped EXE 1 IoCs

pid	Process
312	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 312	4516	8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe	90
PID 4516 wrote to memory of 312	4516	8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe	90
PID 4516 wrote to memory of 312	4516	8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe	90

C:\Users\Admin\AppData\Local\Temp\8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe
"C:\Users\Admin\AppData\Local\Temp\8209f6fd6592c2e6caae067f298e60308744be083a88086cb67f14cd597bf850.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
71KB

MD5
d7436e8eba176d303a11b4ffede36c1e

SHA1
210b78ca4a5623619c34f6b2723404c50704c1da

SHA256
384d585a64b3ddd42f372dcbddb956f8f3ca5d0b0710c8df15bc220cfc220536

SHA512
74df0e9537ae5a16356cf36d29990b20b546dea2086765a5bf0896d799054ce222736a1c6c7382f91fc04bf441eca3495962a061160527dda8ae22aef64a81e2

Download Submit