upatre | 74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2026f597d0b6374773785047d436b868.exe
Size

103KB
MD5

2026f597d0b6374773785047d436b868
SHA1

a91ca135b57a72e44ac7d8b9f68cbec994a7d6b1
SHA256

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263
SHA512

231f0950fa87b1576a26c6945d41d5900b5aa7f4490e36cac63a6e472a6d799c1b104fb7bb24d1f23828003088cbda916fb403bcf2b06b008b5fb850f1336a12
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMaTZu:iY9CUT62/UOVMu8i8N898b8XN8X98XGV

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid	Process
2528	szgfw.exe

Loads dropped DLL 2 IoCs

Processes:

2026f597d0b6374773785047d436b868.exe

pid	Process
2856	2026f597d0b6374773785047d436b868.exe
2856	2026f597d0b6374773785047d436b868.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2026f597d0b6374773785047d436b868.exe

description	pid	Process	procid_target
PID 2856 wrote to memory of 2528	2856	2026f597d0b6374773785047d436b868.exe	28
PID 2856 wrote to memory of 2528	2856	2026f597d0b6374773785047d436b868.exe	28
PID 2856 wrote to memory of 2528	2856	2026f597d0b6374773785047d436b868.exe	28
PID 2856 wrote to memory of 2528	2856	2026f597d0b6374773785047d436b868.exe	28

C:\Users\Admin\AppData\Local\Temp\2026f597d0b6374773785047d436b868.exe
"C:\Users\Admin\AppData\Local\Temp\2026f597d0b6374773785047d436b868.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
103KB

MD5
5c2e07aa9eef8f795258fdc806f08d86

SHA1
6f906fe92a16d28a8e9e1b6870d4256498620126

SHA256
71ce7027594fa0e0920962320f42ff903807410f01787ef93051d872510926d5

SHA512
b6922388eec21d08eaa9aef79236d1176b4d6d9cbd163e524eeca2706796b27d0725dad0c5365c591f44347481421f3ba520b4e3775e4322ecce876c95e58bc1

Download Submit
memory/2856-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2856-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download