upatre | 2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-03-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe
Size

103KB
MD5

6c17d906687ffde9d566d799d8f9230c
SHA1

914089c8083cdf929987f728e584ad79d222a68b
SHA256

2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317
SHA512

e34bb73baed15350515819d7fa0cbd3d6553746b12c6cf87a61993b7d53cd905eafc2ec6bb9bd1c057b39b68602a4cc118ddceb00c40b5b81b049d7a7c0d5f12
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMaTZm:iY9CUT62/UOVMu8i8N898b8XN8X98XGl

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
3016	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
3028	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe
3028	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3016	3028	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	28
PID 3028 wrote to memory of 3016	3028	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	28
PID 3028 wrote to memory of 3016	3028	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	28
PID 3028 wrote to memory of 3016	3028	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	28

C:\Users\Admin\AppData\Local\Temp\2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe
"C:\Users\Admin\AppData\Local\Temp\2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
103KB

MD5
1e9e2d90aa1fa79dfc9f88c82b27ed8a

SHA1
37d4cc25463f12fd47269aa65b89c6ed82ef71ad

SHA256
a5abcad98da683617727a62adb18e86b9e458772363b091e14595a861fba0fcc

SHA512
7ad6d5ad5b6af8e712be399f94d727467ef43f318da7bb1c7d76d562648494d03a33cd78e4076155f748423b60f58129514b572f1dd1f88bc239f0b11e7f5cf2

Download Submit
memory/3028-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3028-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download