upatre | 020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07

Analysis

max time kernel
155s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe
Size

77KB
MD5

8eae7a5a307417ce70f0f175de2167cd
SHA1

0da8bc8e916ccdc6036c2593f965c5ca7e7fbfb3
SHA256

020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07
SHA512

88e1e65f830c49a7849c78d9a099d986a91dfcfebfdb68de283b5be00d1b3fb06789100a659301ed7491395610fa7fae76bbbe6405242172aa3585dff1718177
SSDEEP

1536:vCWDKUlsCZD1mh8txVQnlRIFYK4Ncp1wDLq7O:6hjTl

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe

Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

1432 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1432	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe

description	pid	process	target process
PID 4848 wrote to memory of 1432	4848	020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe	szgfw.exe
PID 4848 wrote to memory of 1432	4848	020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe	szgfw.exe
PID 4848 wrote to memory of 1432	4848	020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe
"C:\Users\Admin\AppData\Local\Temp\020620413ae62b580f53081b223af78d36909b24f42ca1cb4963a84a8bf02f07.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4848

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
77KB

MD5
27967b84d237799b35eba47d96c49514

SHA1
96f96d5c45e276fd0a01d15fd1000a1e2b61010c

SHA256
d4d134ccda9d5968955251a11850c7f8c424d3cdb7bca3433e2dd527bd7deb17

SHA512
6e8545e49ca4bacac4c07f031951e98c9a9d3b8502557b24e1d89e261684e6e4f5007d9506e1b7e8c20ed8d60b5b124da9c0e66f284112c025154e9e682ce85d

Download Submit