upatre | a11b40f95a5718651867a18797eef2a04049ea5e0f643b92ee7750a40ff6c41c

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe
Size

8KB
MD5

7723ecdaa7848d9749ab4a5a1878f0b0
SHA1

3233aed74a7e8867cdd013db464e2ffc02b269a8
SHA256

a11b40f95a5718651867a18797eef2a04049ea5e0f643b92ee7750a40ff6c41c
SHA512

3c6c731445ae0700a6a7ac19646cb91230d88b1a99f327eb929e3f15284c15221a43657c92dfe79b51d0946237ddd28c569d517a06aaffd847cb917be551c8b6
SSDEEP

192:IFsXvZsk3d/ZcfFaQZT6CSJB8Oye3Q4pagU5lLf:asX7d/ZctaQZT6CSB8Oye3Q4K5pf

Score

10^/10

upatre downloader upx

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
272	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2944	7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe
2944	7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2944-0-0x0000000000400000-0x0000000000406000-memory.dmp	upx
behavioral1/files/0x000c00000001450b-3.dat	upx
behavioral1/memory/2944-5-0x0000000000490000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/272-12-0x0000000000400000-0x0000000000406000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 272	2944	7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 272	2944	7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 272	2944	7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 272	2944	7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7723ecdaa7848d9749ab4a5a1878f0b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
8KB

MD5
771ddff42dd3ed1cea2e1a1b968cf274

SHA1
e49c117049ee2a7ba770977dc0c91f65fe70f231

SHA256
bea69887c02db9dc047b5641babbb7caed16f36b8647175b62ff9d1757ab2c74

SHA512
903bfcddef334a9e2ceb1bc558a3a7dabec2a6407fe317d2403755facafcacf827de8715250b17277ca59a6cbaa8b1cbc5e73e5106ca0fe4c2bff97d0a4d1fe2

Download Submit
memory/272-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2944-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2944-5-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download