upatre | 4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
Size

4KB
MD5

7094bd5d4a39ed587d7c55b974f8a927
SHA1

e5e6b1f8bc382026cb2fc19974c74c71c865515e
SHA256

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03
SHA512

ac50d83a77d1390ec9d883734c96677c0512efa8f8783b0f0209f201196925cb4852ce15610593d273a4cc4e5be2afa96e08f62c591e09345447e30257de697f
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rsqg/tKnA7B8mOo4jUx7OtKGk:Z0v4mUWKh9ctgC1RVEtKnKymV44ShiD

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

1768 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe

pid process

1232 4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
1232 4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1768	szgfw.exe

pid	process
1232	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
1232	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe

description	pid	process	target process
PID 1232 wrote to memory of 1768	1232	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	szgfw.exe
PID 1232 wrote to memory of 1768	1232	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	szgfw.exe
PID 1232 wrote to memory of 1768	1232	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	szgfw.exe
PID 1232 wrote to memory of 1768	1232	4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe
"C:\Users\Admin\AppData\Local\Temp\4e57732ed0e234c660b46088ec38dfbb1e122100560b332ef63a167592dfcf03.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:1768

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
4KB

MD5
143dbcbd640c57c15d988a03bda40b64

SHA1
5a2139c18446025b1215b30d25a3981bf38b01da

SHA256
708e1efba83783869d829cc6d4154349c6bfcb9b3e4b768e605adad392ed30a6

SHA512
2781c52957ccf9e66db49ce71d988d22786bdd022bf513f26b77575dfebd3adce49e924a298d1af84a021f0129d2b3cb081e32e173aa6aeda21e2db8381191e4

Download Submit