upatre | f9578cf7b4915ec42d1f9954299ed34bb85e701101e024e65309c8a7a550ec69

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe
Size

68KB
MD5

2ec3ae13b9bdc2dfdb598e20ae327fd0
SHA1

601e71150f9440e33570b5baccffd067c1ab2e3c
SHA256

f9578cf7b4915ec42d1f9954299ed34bb85e701101e024e65309c8a7a550ec69
SHA512

e2a5481e21395591db9a42d00e69330c362f44544b74eaedaf6e5fea491005fd2709d7ddaa1dfb57ba5f35302bf1613706c58887e8de3bb246cb95684b30a175
SSDEEP

1536:5Y9jw/dUT62rGdiUOWWrMffJ+AxM+I+ceWgP/KmVQV:5Y9CUT62/UOVMffJ+AW+I+cR

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3264	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3264	4140	2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe	91
PID 4140 wrote to memory of 3264	4140	2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe	91
PID 4140 wrote to memory of 3264	4140	2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2ec3ae13b9bdc2dfdb598e20ae327fd0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
68KB

MD5
af961505f1288fd14840bfa98bc066ed

SHA1
63a5fdee67545c9e41a718acf981614f1c183351

SHA256
b7bacf8d43b5f2ced83fc4a7de3aace9400f2bee01f61807764d37e710c8642e

SHA512
73b55978c21621473353c10be7c07959fa536d792bdd8994160439a2550d3f6dc9c947198a71096c157dcae2664437fb1162f0c50d9e7d5cd30c3495cc36b522

Download Submit
memory/3264-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4140-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/4140-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download