upatre | 700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
Size

103KB
MD5

87911017e926e50cc83551ffa3e77946
SHA1

8f3c2458f0a89a090a241eccf98af5b858acde4f
SHA256

700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b
SHA512

ee27353a73dd326a44f3a049f1a20b37e41f02398257578432392ac2146b11debbcd4d15716f28fef79369d9dd12bdc6968db958c425daad2f583794f9ab4224
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMTK7zY:iY9CUT62/UOVMu8i8N898b8XN8X98XGJ

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe

Executes dropped EXE 1 IoCs

pid	Process
2908	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2908	1844	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	94
PID 1844 wrote to memory of 2908	1844	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	94
PID 1844 wrote to memory of 2908	1844	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	94

C:\Users\Admin\AppData\Local\Temp\700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
"C:\Users\Admin\AppData\Local\Temp\700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
103KB

MD5
95e7e8575a39dd2ebd552d7878b8ecfc

SHA1
07646b854db1a11f80d510e00dde95cc833fa9aa

SHA256
a6bb35aef949f453c019b1932f33c78bbea7dfe06c3f031fc1ac1ffa867e4301

SHA512
f92a6fd483c368448fdc6b0d67ed49d1d5768f7dcd0f3af51aa1c7f6b791ce8972577e4a346aeca407c3ed2ee228b80b2292178c9deac4d7e28ecbfa35b6a2c8

Download Submit
memory/1844-0-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1844-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2908-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download