upatre | f9f30c96e8beef5d7d0968989a136fedaccab715e97285300288e772b04ddf93

Resubmissions

08-10-2024 01:26

241008-btlm4a1hqq 10

28-05-2024 13:49

240528-q4v2vafh7v 10

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
Size

4KB
MD5

46c440527c7d4395372773dc8c54bd80
SHA1

65f006375e3d65379df3c1627ce267f8d987ffe7
SHA256

f9f30c96e8beef5d7d0968989a136fedaccab715e97285300288e772b04ddf93
SHA512

4a8edca21b8b8fd98294724171b150a5535803c1f3a870d62460d554448d86401e430089031d11548e4e9ee7f8e7fd3c1063dae404d0e701e5e37b99e1e1b8eb
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rs1lnA7B8mOo4jUx7OtKGc3IS:Z0v4mUWKh9ctgC1RUnKymV44ShiD

Score

10^/10

upatre discovery downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid	Process
3168	szgfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exeszgfw.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe

description	pid	Process	procid_target
PID 2168 wrote to memory of 3168	2168	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	84
PID 2168 wrote to memory of 3168	2168	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	84
PID 2168 wrote to memory of 3168	2168	46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
4KB

MD5
3de0c64336d613bdd742aa8cf52beb0b

SHA1
052525f5ce70b305b00d97b172835ce0cad52d37

SHA256
62d89ec0b4be408b1cb933e0eda1697f6300c0d28baed696c013c613d1bd9c3b

SHA512
68f1b23095ab3bd3fde5ab3f81ea395d3e2448482014c72fe6f464015eaf4a844013f63d23f98bec1b46e0d76386ec74228122b62039ac32f707e5518a324605

Download Submit