Analysis

  • max time kernel
    119s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 04:43

General

  • Target

    d909b9679d24c9826912193eec624363753f67aca0d614248e1601c49ce1a806N.exe

  • Size

    13KB

  • MD5

    f6dee26e462aa2e5fbc380cae996d3f0

  • SHA1

    7191102b294e3a1d45c2d0230afe26ea390bbc18

  • SHA256

    d909b9679d24c9826912193eec624363753f67aca0d614248e1601c49ce1a806

  • SHA512

    7ecd05b0437ddd055ba354ca82b2151dba7a42022bf7f428c6bf12342d127950ba9f5614dbdc7ba9aabdfa100e65c4e39038e3bc355b9f29e472b838fa3ac78c

  • SSDEEP

    384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjKhYsKUAylUmWmtsh:v+dAURFxna4QAPQlYghxKUAyl9Wm4

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Upatre family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d909b9679d24c9826912193eec624363753f67aca0d614248e1601c49ce1a806N.exe
    "C:\Users\Admin\AppData\Local\Temp\d909b9679d24c9826912193eec624363753f67aca0d614248e1601c49ce1a806N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe

    Filesize

    13KB

    MD5

    b6b05d6b39887e182c38273954c441b4

    SHA1

    2f38cecf71dbcb63ecfb6269fde2b67f617831ff

    SHA256

    ead5c9931dbea16cd2f6200abdfc9f062c39c411161d7df81249fad55ff153de

    SHA512

    6d92d9b09efc2613dffd60d91d40534678f2767d5ba04fb15474adacddf3f077142c9ee6a63f3411f6211c92ba2dc48955f420d3dc74af4acb9fded051d36a55