Overview

overview

10

Static

static

3

750c3c64b0...cs.exe

windows7-x64

10

750c3c64b0...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 04:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe

  • Size

    68KB

  • MD5

    750c3c64b0be8dc817ed59aaff2a6690

  • SHA1

    5cbead18e004ebb4ed9704bce58df1bd1aae0813

  • SHA256

    80bfc21b7f8292bc24f9ea0b26cdc45073d701113a45590585f9f4cdc0cbfe76

  • SHA512

    203fe77dff0b6639cf533de1068418102adc91665535932d41a4f33ae9df594bd9537be36d61ebe553791b41ed1ebfd736212e6ed28cefde8863fd0db35fa575

  • SSDEEP

    1536:5Y9jw/dUT62rGdiUOWWrMffJ+AxM+I+ceWgP/KmVQ8:5Y9CUT62/UOVMffJ+AW+I+cY

Score
10/10
upatredownloader

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

    downloaderupatre
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\750c3c64b0be8dc817ed59aaff2a6690_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:3108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
    Filesize

    68KB

    MD5

    31cdcc9ec4823e216622ee006cd0a002

    SHA1

    19a3fabf7728b50745499463b7640cbbf7a1e8b8

    SHA256

    10087cababf82afb36dc3e81adb15bc8ad3bc97e7fdaedfcccbc73e1ffc8269b

    SHA512

    61272016bcb10aebb9f87f96fe47a5eab5268298a487c86ceb2369836bec800e5ffc98a6e80fb754f6786083d2616231ef95f1d3c6dc7432f32df1d3ef7ec8f0

    Download Submit
  • memory/2024-1-0x00000000006C0000-0x00000000006C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2024-8-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

    Download
  • memory/3108-10-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

    Download