upatre | 1240f84ae11b51ca9766ec2a76bae948617057743ffa65b9cfb180bd25e8e7e5

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe
Size

399KB
MD5

8ccba27524702aa439f9d96a4839e880
SHA1

b04931256c2c29ba90187f690abc0650f0296c67
SHA256

1240f84ae11b51ca9766ec2a76bae948617057743ffa65b9cfb180bd25e8e7e5
SHA512

3c3c02ceca4b8f772e3e1ee4cfb63bc28b13abe71e83aa9b0c59de368218f4a095c19ce1e94e8da0e4b5ed174419f8452b264a1f13c9a1a5a769e4849cb6bc43
SSDEEP

6144:GY9C8QyNrFwMvv4ZQ5lV8TDk9F1vtANCX2G8NTW5za8DkAd44y:GAfOMgQ5luq2GE

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2380	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2380	2776	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe	96
PID 2776 wrote to memory of 2380	2776	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe	96
PID 2776 wrote to memory of 2380	2776	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
399KB

MD5
ab41be9881aa9c0483a605342748d01a

SHA1
b54ae55cfbd91d02be126e7234eea1a78c2b6bde

SHA256
87907e8e70e4a6cf774cb968f1589cc6e6b1606c0dac14e2c5490677930bc89f

SHA512
d60539aa4f93b74c15993d2ef736ec3c672324d0eea920b592800f4f5df22c3e739825f1d6fb30ac935c041bace984c03f294d6b8f6c162a39f4f70b18be39a4

Download Submit
memory/2380-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2776-1-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2776-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download