Analysis
-
max time kernel
153s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-04-2024 19:30
Static task
static1
Behavioral task
behavioral1
Sample
25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe
Resource
win10v2004-20240226-en
General
-
Target
25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe
-
Size
39KB
-
MD5
3e7a567a7bb170154c22a1278c1820a6
-
SHA1
8a8e810bab4bdfa7668fd1034ebb49a8f4a7edbb
-
SHA256
25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c
-
SHA512
e46eb262d1075b3e018cee51ee22daf58216cdae5f3153b86c1631113c2a79ff185e345b35eb9ec496244881ae4b7df6fdd4a98876544c63c608bcce356b8584
-
SSDEEP
768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95k5bNITnJy/rQIAWPQ:GY9jw/dUT62rGdiUOWWrNmBsr
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Executes dropped EXE 1 IoCs
pid Process 2996 szgfw.exe -
Loads dropped DLL 2 IoCs
pid Process 2848 25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe 2848 25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2996 2848 25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe 28 PID 2848 wrote to memory of 2996 2848 25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe 28 PID 2848 wrote to memory of 2996 2848 25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe 28 PID 2848 wrote to memory of 2996 2848 25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe"C:\Users\Admin\AppData\Local\Temp\25b43df44432900f2a1239d986d19d48e6730adf2a1a68cd38a76e8596d1727c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5227cddfed3bfe213ef3f0f5ceb61bc37
SHA1c423d22ddb998b7d8a0a7670da3b869101dd704b
SHA2560aa1367c7c7f79c0422f9aba2caa0f3cb55d69fe836eb39ee583a6561e021e91
SHA5123f87b1f6e7b304821cd94163e7515921b7b527ba189faefeedc0e42da1b3e4fd09740aab3839d19fc7f45c540ea23167b2d1ffb4ffa3932814c3cb04204af254