Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-12-2024 02:38
Static task
static1
Behavioral task
behavioral1
Sample
b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe
Resource
win10v2004-20241007-en
General
-
Target
b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe
-
Size
37KB
-
MD5
a0ac9d59b298230d3a5e737f268007b6
-
SHA1
3c0db5142bb28b2b49e9743c25ed4d084981fc26
-
SHA256
b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc
-
SHA512
5f9130bac208eae021ca81e7e0a24444e3de602111718951fa6edc93ea2ab686ea01b70ea46a153941847ce09202e4f7cd7e813dd3af6f7db63b9a2af4405fef
-
SSDEEP
768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95k5mw0+7Mb:GY9jw/dUT62rGdiUOWWrNmT7Mb
Malware Config
Signatures
-
Upatre
Upatre is a generic malware downloader.
-
Upatre family
-
Executes dropped EXE 1 IoCs
pid Process 2788 szgfw.exe -
Loads dropped DLL 2 IoCs
pid Process 2648 b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe 2648 b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2788 2648 b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe 30 PID 2648 wrote to memory of 2788 2648 b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe 30 PID 2648 wrote to memory of 2788 2648 b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe 30 PID 2648 wrote to memory of 2788 2648 b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe"C:\Users\Admin\AppData\Local\Temp\b664c98845ceadb9bccbcfc657a28b77d240cb37f6f0a2fa158fecefa4107dbc.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\szgfw.exe"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"2⤵
- Executes dropped EXE
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD589ca43a87d73b1cdcf35ffc0d1cc4d15
SHA1eb59c17c056b8b335926bb9b43daeba00493ec0e
SHA25688af4871053c539f691e70249b497121ea28abea61540b9808edb49ccaa59185
SHA5122464c809722bdfbef4804351b1d3408f9853203c5c4463852adeb7643f014553dfbf5febfbbb0837136af776779be8fe5431b0275d5c0dfbd0103433d1875d00