upatre | f9f30c96e8beef5d7d0968989a136fedaccab715e97285300288e772b04ddf93

Resubmissions

08-10-2024 01:26

241008-btlm4a1hqq 10

28-05-2024 13:49

240528-q4v2vafh7v 10

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
Size

4KB
MD5

46c440527c7d4395372773dc8c54bd80
SHA1

65f006375e3d65379df3c1627ce267f8d987ffe7
SHA256

f9f30c96e8beef5d7d0968989a136fedaccab715e97285300288e772b04ddf93
SHA512

4a8edca21b8b8fd98294724171b150a5535803c1f3a870d62460d554448d86401e430089031d11548e4e9ee7f8e7fd3c1063dae404d0e701e5e37b99e1e1b8eb
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rs1lnA7B8mOo4jUx7OtKGc3IS:Z0v4mUWKh9ctgC1RUnKymV44ShiD

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2496	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
3012	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
3012	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2496	3012	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2496	3012	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2496	3012	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2496	3012	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
4KB

MD5
3de0c64336d613bdd742aa8cf52beb0b

SHA1
052525f5ce70b305b00d97b172835ce0cad52d37

SHA256
62d89ec0b4be408b1cb933e0eda1697f6300c0d28baed696c013c613d1bd9c3b

SHA512
68f1b23095ab3bd3fde5ab3f81ea395d3e2448482014c72fe6f464015eaf4a844013f63d23f98bec1b46e0d76386ec74228122b62039ac32f707e5518a324605

Download Submit