Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 03:41

General

  • Target

    da6b5ddff3017a219076704da8eeacf6a47ac2b0829193937bcc9b5688c87d22.exe

  • Size

    71KB

  • MD5

    91b1543bbb603afa0bc7cb0b0ccaadd8

  • SHA1

    97f700a81ecc68f79d14e3b6b2567b341e6523af

  • SHA256

    da6b5ddff3017a219076704da8eeacf6a47ac2b0829193937bcc9b5688c87d22

  • SHA512

    736f3b19e210515dd077274ca5d7536497b42f0f3185d5fb1e55d92226c9873ea43682b53d68ce2d3269b3753b5742aef33534f528e90320400d012ee72644ac

  • SSDEEP

    1536:5Y9jw/dUT62rGdiUOWWrMffJ+AxM+I+ceWgP/KmVQo3:5Y9CUT62/UOVMffJ+AW+I+cE

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da6b5ddff3017a219076704da8eeacf6a47ac2b0829193937bcc9b5688c87d22.exe
    "C:\Users\Admin\AppData\Local\Temp\da6b5ddff3017a219076704da8eeacf6a47ac2b0829193937bcc9b5688c87d22.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    Filesize

    71KB

    MD5

    cc6b050f752ee4453b297d6d14d66cf7

    SHA1

    bcc1c97d3b9d765f71cc075204066791c9c4f020

    SHA256

    417e15356293614c2b996fdae9ee0dfdda04cfdafd0a2afd8a33dacba42f1791

    SHA512

    0343ee72af0b2cdc933a35f1bd58b5752b7fd1e11cef3e96ae81bde0f0f63f7a3cf045188972ab718f7803171c339176b332c0dfef28512d4216092ec0a8c294

  • memory/4456-1-0x0000000000580000-0x0000000000581000-memory.dmp

    Filesize

    4KB

  • memory/4456-9-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4864-10-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB