upatre | cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
Size

4KB
MD5

591116c8465540f45bf93d2aea12fc7b
SHA1

8863bec89b01bc6ec93b14cfc0b104058b5256d7
SHA256

cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f
SHA512

eafcaff1e9f4b9d7ac96bea3d13199227fe6d8f195c6153edbcb522ad752a0a1ac5c6e0d1d23c4e39ced88e19d90e601f5ce55a1dbbb33da06c0a359d19ad80c
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rs1znA7B8mOo4jUx7OtKGcQEl:Z0v4mUWKh9ctgC1RGnKymV44ShC7+quQ

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe

Executes dropped EXE 1 IoCs

pid	Process
772	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 772	3648	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	83
PID 3648 wrote to memory of 772	3648	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	83
PID 3648 wrote to memory of 772	3648	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	83

C:\Users\Admin\AppData\Local\Temp\cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
"C:\Users\Admin\AppData\Local\Temp\cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
5KB

MD5
9c96c96943b871b60db12e24ace5a202

SHA1
079a8bdd926217872b86a6ac56d5c5d78cb21e8f

SHA256
138df5d6b0c48eff82e0d0e79874364994303b19c31b42654831cdedc3f9583f

SHA512
5f8cd10aba01da5b483090332ff40710c07bffc3e8ba4c520abb7ecae5dcd0c7cc414e607b2eaec97748b6aad464d0d2fc7edcf0c5ae6032245e12befb6b3d33

Download Submit