upatre | 8c402ac40afddc4842ae2f8bf48c762512a81d930b9b16591e36780b556e84de

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe
Size

4KB
MD5

5e9d32306f4ef655d4a768f5d5822bb0
SHA1

e7ad13297718b6d0f67e84764875930957db813a
SHA256

8c402ac40afddc4842ae2f8bf48c762512a81d930b9b16591e36780b556e84de
SHA512

1f9738031e95fe005579e9eabf71e79f05440bbc122b8c7160e7dd672934952e605719215039186449b3d99e7f0556a11bc3015d43d6f636292fb2916008cd99
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91RsyDknA7B8mOo4jUx7OtKGc3Q:Z0v4mUWKh9ctgC1RFknKymV44ShiY/

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe

Executes dropped EXE 1 IoCs

pid	Process
1696	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1696	4508	virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe	83
PID 4508 wrote to memory of 1696	4508	virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe	83
PID 4508 wrote to memory of 1696	4508	virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe	83

C:\Users\Admin\AppData\Local\Temp\virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_5e9d32306f4ef655d4a768f5d5822bb0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
4KB

MD5
2b7f9ac23553be0b136bb71c2579bc29

SHA1
14f93a9fce37b87d4e4bfadc5cf55995cfea7c75

SHA256
0cc71fcf3ba9058526f50002d0b0a9e2dd05fbec8ef2df841460dad90e17c4e0

SHA512
72afb149d9409d35ef83465440ec8ae335ae173dc27c5a6c49492a100a4ac5591485660d15960395c828a4fb5b467978035845f48b9df59fbab9e2d21b5580c9

Download Submit