upatre | 74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
Size

103KB
MD5

2026f597d0b6374773785047d436b868
SHA1

a91ca135b57a72e44ac7d8b9f68cbec994a7d6b1
SHA256

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263
SHA512

231f0950fa87b1576a26c6945d41d5900b5aa7f4490e36cac63a6e472a6d799c1b104fb7bb24d1f23828003088cbda916fb403bcf2b06b008b5fb850f1336a12
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMaTZu:iY9CUT62/UOVMu8i8N898b8XN8X98XGV

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2172	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	28
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	28
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	28
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	28

C:\Users\Admin\AppData\Local\Temp\74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
"C:\Users\Admin\AppData\Local\Temp\74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
103KB

MD5
253735cd88ed70d8441839cbb58502fc

SHA1
1b0e480a78fcb49077aa7f096cc6fdf0083854a9

SHA256
f0b67102dbf15f7bc88e5a521ef261c3d72351101664a76999c7e744ce6d5a28

SHA512
1a161d6f535f0da8718bd3361f2569c3230c47ee5354480b8a1047ac4b4a40c317b294fb328d5319cd2083498d413d6ba9ee877f46de3fcb3ccd58a3c5e7ca9b

Download Submit
memory/2364-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2364-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download