upatre | 700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
Size

103KB
MD5

87911017e926e50cc83551ffa3e77946
SHA1

8f3c2458f0a89a090a241eccf98af5b858acde4f
SHA256

700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b
SHA512

ee27353a73dd326a44f3a049f1a20b37e41f02398257578432392ac2146b11debbcd4d15716f28fef79369d9dd12bdc6968db958c425daad2f583794f9ab4224
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMTK7zY:iY9CUT62/UOVMu8i8N898b8XN8X98XGJ

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2252 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe

pid process

2244 700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
2244 700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2252	szgfw.exe

pid	process
2244	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
2244	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe

description	pid	process	target process
PID 2244 wrote to memory of 2252	2244	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	szgfw.exe
PID 2244 wrote to memory of 2252	2244	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	szgfw.exe
PID 2244 wrote to memory of 2252	2244	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	szgfw.exe
PID 2244 wrote to memory of 2252	2244	700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe
"C:\Users\Admin\AppData\Local\Temp\700c225698c531814d3a220452075b4d5972dd37920f6a925986dbafd7bc696b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2252

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
103KB

MD5
95e7e8575a39dd2ebd552d7878b8ecfc

SHA1
07646b854db1a11f80d510e00dde95cc833fa9aa

SHA256
a6bb35aef949f453c019b1932f33c78bbea7dfe06c3f031fc1ac1ffa867e4301

SHA512
f92a6fd483c368448fdc6b0d67ed49d1d5768f7dcd0f3af51aa1c7f6b791ce8972577e4a346aeca407c3ed2ee228b80b2292178c9deac4d7e28ecbfa35b6a2c8

Download Submit
memory/2244-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2244-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download