Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 00:58

General

  • Target

    8b3dc738630960af2fa7f7b56e753d693da8ebe38c273039e25086e2305f020f.exe

  • Size

    36KB

  • MD5

    ecb28c3e5cc4c9eb89c4a12558fce6d5

  • SHA1

    3bfdde291fd1fdb84bc4bbbfe14afbdb76b63dd3

  • SHA256

    8b3dc738630960af2fa7f7b56e753d693da8ebe38c273039e25086e2305f020f

  • SHA512

    282426245c1efd8cab35ce73e626c7dd9835bb14c3cb121ec552b730845cded83eea72a45d40022dfef91c04da29971ca0a248eff97657ddadabe5d1e3b00886

  • SSDEEP

    768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95k5mwGx:GY9jw/dUT62rGdiUOWWrNmE

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Upatre family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b3dc738630960af2fa7f7b56e753d693da8ebe38c273039e25086e2305f020f.exe
    "C:\Users\Admin\AppData\Local\Temp\8b3dc738630960af2fa7f7b56e753d693da8ebe38c273039e25086e2305f020f.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    Filesize

    36KB

    MD5

    a349eaed05840aa6c397d0962b88d4e6

    SHA1

    3b599f24bd1605f318c4c573c3f569d7924b0b1f

    SHA256

    be1e0a9dd7231b753de855197b902dae8a7fed19312b6497457891f47aa1888e

    SHA512

    7236b1b16ec9e2dce35b908ceb746dddea4ed0c82e8a414737ae6628490ef71e6168194efe941be9f321a7f44c0da757995593877c0c1fe2afb6c10f3e112d03

  • memory/1748-0-0x0000000000490000-0x0000000000491000-memory.dmp

    Filesize

    4KB

  • memory/1748-9-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3540-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB