upatre | 723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe
Size

37KB
MD5

5abf1a35d94af755551a6c437c23aa61
SHA1

3bfbed5d70d55b8bf01fe81c7f4af841afbf6aa3
SHA256

723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c
SHA512

c2fc43df1a3ecc81b225dfabb91b16be3822c6fe08c56562a699849850e34408a30515556d35236ba51fd921f51e619812927ad5fa4b25036881f2f2bda45b6a
SSDEEP

768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rh95k5mwtb:GY9jw/dUT62rGdiUOWWrNmP

Score

10^/10

upatre discovery downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Upatre family
upatre

Executes dropped EXE 1 IoCs

pid	Process
2024	szgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
2376	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe
2376	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2024	2376	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe	30
PID 2376 wrote to memory of 2024	2376	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe	30
PID 2376 wrote to memory of 2024	2376	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe	30
PID 2376 wrote to memory of 2024	2376	723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe	30

C:\Users\Admin\AppData\Local\Temp\723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe
"C:\Users\Admin\AppData\Local\Temp\723ff4634b0f48eef4b244b736cf81d74ac7a16f10ffb633c6949ba20455905c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\szgfw.exe
  "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe

Filesize
38KB

MD5
98b9c130b155b8507bac81d60442208b

SHA1
1b6749188a3001d9fd290af9880ae0820fddfc23

SHA256
69d44d3951e0f997a31e38dbea4da699ce438032a6bfee9231576177122fc1de

SHA512
05522c6a8db4618ae2f5a403cea09bcffe02f58390b8ebf1407a1afa79785a07d4f2b9ef41e3d60616f43a319f2d89bbf4eae364a625d4e574864fd14bf4eb34

Download Submit
memory/2024-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2376-0-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2376-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download