upatre | 80bfc21b7f8292bc24f9ea0b26cdc45073d701113a45590585f9f4cdc0cbfe76

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe
Size

68KB
MD5

750c3c64b0be8dc817ed59aaff2a6690
SHA1

5cbead18e004ebb4ed9704bce58df1bd1aae0813
SHA256

80bfc21b7f8292bc24f9ea0b26cdc45073d701113a45590585f9f4cdc0cbfe76
SHA512

203fe77dff0b6639cf533de1068418102adc91665535932d41a4f33ae9df594bd9537be36d61ebe553791b41ed1ebfd736212e6ed28cefde8863fd0db35fa575
SSDEEP

1536:5Y9jw/dUT62rGdiUOWWrMffJ+AxM+I+ceWgP/KmVQ8:5Y9CUT62/UOVMffJ+AW+I+cY

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2984	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2272	750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe
2272	750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2984	2272	750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe	28
PID 2272 wrote to memory of 2984	2272	750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe	28
PID 2272 wrote to memory of 2984	2272	750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe	28
PID 2272 wrote to memory of 2984	2272	750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
68KB

MD5
31cdcc9ec4823e216622ee006cd0a002

SHA1
19a3fabf7728b50745499463b7640cbbf7a1e8b8

SHA256
10087cababf82afb36dc3e81adb15bc8ad3bc97e7fdaedfcccbc73e1ffc8269b

SHA512
61272016bcb10aebb9f87f96fe47a5eab5268298a487c86ceb2369836bec800e5ffc98a6e80fb754f6786083d2616231ef95f1d3c6dc7432f32df1d3ef7ec8f0

Download Submit
memory/2272-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2272-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2984-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download