upatre | 0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe
Size

4KB
MD5

18a51c9efe860d9856ca2c934f4403bd
SHA1

62269c42fcf2d2ba123c2411af2cdb4d1f15495f
SHA256

0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d
SHA512

d01e661b201dd8ffef016c21be23ad7de974c197b55f8416b3f68ed118570c3ab21625ce29afbc22f35a9cd246f1c4220d9bbeac8e20848aa5a93a4aa8a1780b
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91RslP6nA7B8mOo4jUx7OtKGc32:Z0v4mUWKh9ctgC1RGynKymV44Shi2

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

2612 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe

pid process

2072 0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe
2072 0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2612	szgfw.exe

pid	process
2072	0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe
2072	0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe

description	pid	process	target process
PID 2072 wrote to memory of 2612	2072	0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe	szgfw.exe
PID 2072 wrote to memory of 2612	2072	0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe	szgfw.exe
PID 2072 wrote to memory of 2612	2072	0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe	szgfw.exe
PID 2072 wrote to memory of 2612	2072	0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe
"C:\Users\Admin\AppData\Local\Temp\0bd63792e194c7cf1b02d73bbb916f8ac373adfe036e1e14f1836bf54c4d470d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:2612

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
4KB

MD5
a63a6dce0965f9fc93d42af3b1e17787

SHA1
3bdead9a149bea98f486d8f293af1ac496e6afbb

SHA256
fedd09fdbebfd1ad3fe813c6bdc4ef1b1c6052e52a500d9c207fae15c0ae1224

SHA512
e1f461da78ed308a912ac9ebf7d5a230ca3de8fa48f681110fbed3c6bb345395127bf9dfbf34ed2aeb144f059a19c94a69474f882eca30f745b5e49151913890

Download Submit