upatre | 2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317

Analysis

max time kernel
154s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe
Size

103KB
MD5

6c17d906687ffde9d566d799d8f9230c
SHA1

914089c8083cdf929987f728e584ad79d222a68b
SHA256

2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317
SHA512

e34bb73baed15350515819d7fa0cbd3d6553746b12c6cf87a61993b7d53cd905eafc2ec6bb9bd1c057b39b68602a4cc118ddceb00c40b5b81b049d7a7c0d5f12
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMaTZm:iY9CUT62/UOVMu8i8N898b8XN8X98XGl

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe

Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

868 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
868	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe

description	pid	process	target process
PID 5080 wrote to memory of 868	5080	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	szgfw.exe
PID 5080 wrote to memory of 868	5080	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	szgfw.exe
PID 5080 wrote to memory of 868	5080	2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe
"C:\Users\Admin\AppData\Local\Temp\2bf6834ce5765d30608ebb7078b8f73e2e80a5ea4e233683d145168f9143c317.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
103KB

MD5
1e9e2d90aa1fa79dfc9f88c82b27ed8a

SHA1
37d4cc25463f12fd47269aa65b89c6ed82ef71ad

SHA256
a5abcad98da683617727a62adb18e86b9e458772363b091e14595a861fba0fcc

SHA512
7ad6d5ad5b6af8e712be399f94d727467ef43f318da7bb1c7d76d562648494d03a33cd78e4076155f748423b60f58129514b572f1dd1f88bc239f0b11e7f5cf2

Download Submit
memory/868-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5080-0-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/5080-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download