upatre | 1240f84ae11b51ca9766ec2a76bae948617057743ffa65b9cfb180bd25e8e7e5

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 21:23

Target

8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe
Size

399KB
MD5

8ccba27524702aa439f9d96a4839e880
SHA1

b04931256c2c29ba90187f690abc0650f0296c67
SHA256

1240f84ae11b51ca9766ec2a76bae948617057743ffa65b9cfb180bd25e8e7e5
SHA512

3c3c02ceca4b8f772e3e1ee4cfb63bc28b13abe71e83aa9b0c59de368218f4a095c19ce1e94e8da0e4b5ed174419f8452b264a1f13c9a1a5a769e4849cb6bc43
SSDEEP

6144:GY9C8QyNrFwMvv4ZQ5lV8TDk9F1vtANCX2G8NTW5za8DkAd44y:GAfOMgQ5luq2GE

Score

10^/10

Upatre
Upatre is a generic malware downloader.
downloader upatre
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2380 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe

pid	process
2380	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe

description	pid	process	target process
PID 2776 wrote to memory of 2380	2776	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe	szgfw.exe
PID 2776 wrote to memory of 2380	2776	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe	szgfw.exe
PID 2776 wrote to memory of 2380	2776	8ccba27524702aa439f9d96a4839e880_NeikiAnalytics.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2380

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
399KB

MD5
ab41be9881aa9c0483a605342748d01a

SHA1
b54ae55cfbd91d02be126e7234eea1a78c2b6bde

SHA256
87907e8e70e4a6cf774cb968f1589cc6e6b1606c0dac14e2c5490677930bc89f

SHA512
d60539aa4f93b74c15993d2ef736ec3c672324d0eea920b592800f4f5df22c3e739825f1d6fb30ac935c041bace984c03f294d6b8f6c162a39f4f70b18be39a4

Download Submit
memory/2380-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2776-1-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2776-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download