upatre | 4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
Size

4KB
MD5

7094bd5d4a39ed587d7c55b974f8a927
SHA1

e5e6b1f8bc382026cb2fc19974c74c71c865515e
SHA256

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03
SHA512

ac50d83a77d1390ec9d883734c96677c0512efa8f8783b0f0209f201196925cb4852ce15610593d273a4cc4e5be2afa96e08f62c591e09345447e30257de697f
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rsqg/tKnA7B8mOo4jUx7OtKGk:Z0v4mUWKh9ctgC1RVEtKnKymV44ShiD

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe

Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid	Process
1960	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe

description	pid	Process	procid_target
PID 444 wrote to memory of 1960	444	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	92
PID 444 wrote to memory of 1960	444	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	92
PID 444 wrote to memory of 1960	444	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	92

C:\Users\Admin\AppData\Local\Temp\4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
"C:\Users\Admin\AppData\Local\Temp\4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:444
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2700,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
4KB

MD5
143dbcbd640c57c15d988a03bda40b64

SHA1
5a2139c18446025b1215b30d25a3981bf38b01da

SHA256
708e1efba83783869d829cc6d4154349c6bfcb9b3e4b768e605adad392ed30a6

SHA512
2781c52957ccf9e66db49ce71d988d22786bdd022bf513f26b77575dfebd3adce49e924a298d1af84a021f0129d2b3cb081e32e173aa6aeda21e2db8381191e4

Download Submit