upatre | 034d82fa8a21906c8c21711eeab4dcfa77206ec5a8e1a181e5cf273fed0082f3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe
Size

4KB
MD5

451b6e6869ee29dc55e128a2e2a9fd80
SHA1

c9a39942ffbe59840908477a2770e717bee6275c
SHA256

034d82fa8a21906c8c21711eeab4dcfa77206ec5a8e1a181e5cf273fed0082f3
SHA512

26ef8306e2d600c6b7a6a0f18dc8ac6ff15c27a75d53c47b7738faa27ab3b2998614e834344b13af0d6afaf94fd2b36bcac8050ad425ba046c96c65bc548e5c7
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91RsOIg2nA7B8mOo4jUx7OtKGc:Z0v4mUWKh9ctgC1RVITnKymV44Sh

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
1980	szgfw.exe

Executes dropped EXE 1 IoCs

pid	Process
1980	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1980	1628	451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe	83
PID 1628 wrote to memory of 1980	1628	451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe	83
PID 1628 wrote to memory of 1980	1628	451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\451b6e6869ee29dc55e128a2e2a9fd80_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
4KB

MD5
f43c5de5c1a76c5d37fcfad659e16e00

SHA1
8ddb5a3d9aae2cab5261cb535823f95fa361ef91

SHA256
abaae344fabb9a59cab8569531e814a58cba81d2758f9c823be611f725424d66

SHA512
52374efae06e6fc1a2f0b0330fb1205c8ada8365bf1adca2e47c8910d5540914780ea3cc99d1a62baf0aad4448cd584a3f246501f54f7a84f83228e22f1916bd

Download Submit