upatre | 2167013900ec7ea8257d1d802677d855b14815f2200510ec8e3ea8fe071c1351

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe
Size

4KB
MD5

5327b43596752617c77034bdb5ef8750
SHA1

7972459b05aeb43103e464d3dd17987b1a964b45
SHA256

2167013900ec7ea8257d1d802677d855b14815f2200510ec8e3ea8fe071c1351
SHA512

2421d4fbeb2b0128bb55a99e5ddf9eb817eafc0832b8a6fed028d291a08c9a99c1220381e097114089dbbc04beefce87aac0bce29f9b15eafb4def058667be5f
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91RsKKCnA7B8mOo4jUx7OtKGcQx:Z0v4mUWKh9ctgC1Rd5nKymV44Sh/7

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Executes dropped EXE 1 IoCs

pid	Process
2984	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2972	5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe
2972	5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2984	2972	5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe	28
PID 2972 wrote to memory of 2984	2972	5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe	28
PID 2972 wrote to memory of 2984	2972	5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe	28
PID 2972 wrote to memory of 2984	2972	5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5327b43596752617c77034bdb5ef8750_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
5KB

MD5
33cdadc3beeeacf0edc5426c201c9e98

SHA1
2182f5db3309d4af391d16020d3e9db8e337c794

SHA256
925d92190484bee90822625916afec4e43758d7278d13e99961f0012f29ef66d

SHA512
b2518490d978a6f1f1f1034e5bffb878f246a97652baf5fd45ea47051e42a47a9e0a9c61fccc1b8aeffe419d517cf4a055878336508821718a60b3c6e0d3d013

Download Submit