upatre | 74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
Size

103KB
MD5

2026f597d0b6374773785047d436b868
SHA1

a91ca135b57a72e44ac7d8b9f68cbec994a7d6b1
SHA256

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263
SHA512

231f0950fa87b1576a26c6945d41d5900b5aa7f4490e36cac63a6e472a6d799c1b104fb7bb24d1f23828003088cbda916fb403bcf2b06b008b5fb850f1336a12
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMaTZu:iY9CUT62/UOVMu8i8N898b8XN8X98XGV

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2172 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe

pid process

2364 74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
2364 74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2172	szgfw.exe

pid	process
2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe

description	pid	process	target process
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	szgfw.exe
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	szgfw.exe
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	szgfw.exe
PID 2364 wrote to memory of 2172	2364	74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe
"C:\Users\Admin\AppData\Local\Temp\74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2172

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
103KB

MD5
253735cd88ed70d8441839cbb58502fc

SHA1
1b0e480a78fcb49077aa7f096cc6fdf0083854a9

SHA256
f0b67102dbf15f7bc88e5a521ef261c3d72351101664a76999c7e744ce6d5a28

SHA512
1a161d6f535f0da8718bd3361f2569c3230c47ee5354480b8a1047ac4b4a40c317b294fb328d5319cd2083498d413d6ba9ee877f46de3fcb3ccd58a3c5e7ca9b

Download Submit
memory/2364-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2364-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download