upatre | 74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263

Analysis

max time kernel
206s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 21:42

Target

2026f597d0b6374773785047d436b868.exe
Size

103KB
MD5

2026f597d0b6374773785047d436b868
SHA1

a91ca135b57a72e44ac7d8b9f68cbec994a7d6b1
SHA256

74fb6098ce63d66237c6434234a3f961d679c68605c5d74e84b20a30feb49263
SHA512

231f0950fa87b1576a26c6945d41d5900b5aa7f4490e36cac63a6e472a6d799c1b104fb7bb24d1f23828003088cbda916fb403bcf2b06b008b5fb850f1336a12
SSDEEP

1536:iY9jw/dUT62rGdiUOWWrMu8i8N8tz8b8XtP8XtH8XtgUm2PmsZwGMaTZu:iY9CUT62/UOVMu8i8N898b8XN8X98XGV

Score

10^/10

Upatre
Upatre is a generic malware downloader.
downloader upatre
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

2026f597d0b6374773785047d436b868.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 2026f597d0b6374773785047d436b868.exe
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2300 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2026f597d0b6374773785047d436b868.exe

pid	process
2300	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2026f597d0b6374773785047d436b868.exe

description	pid	process	target process
PID 4920 wrote to memory of 2300	4920	2026f597d0b6374773785047d436b868.exe	szgfw.exe
PID 4920 wrote to memory of 2300	4920	2026f597d0b6374773785047d436b868.exe	szgfw.exe
PID 4920 wrote to memory of 2300	4920	2026f597d0b6374773785047d436b868.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2300

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
103KB

MD5
5c2e07aa9eef8f795258fdc806f08d86

SHA1
6f906fe92a16d28a8e9e1b6870d4256498620126

SHA256
71ce7027594fa0e0920962320f42ff903807410f01787ef93051d872510926d5

SHA512
b6922388eec21d08eaa9aef79236d1176b4d6d9cbd163e524eeca2706796b27d0725dad0c5365c591f44347481421f3ba520b4e3775e4322ecce876c95e58bc1

Download Submit
memory/2300-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4920-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4920-1-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4920-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download