upatre | cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
Size

4KB
MD5

591116c8465540f45bf93d2aea12fc7b
SHA1

8863bec89b01bc6ec93b14cfc0b104058b5256d7
SHA256

cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f
SHA512

eafcaff1e9f4b9d7ac96bea3d13199227fe6d8f195c6153edbcb522ad752a0a1ac5c6e0d1d23c4e39ced88e19d90e601f5ce55a1dbbb33da06c0a359d19ad80c
SSDEEP

48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rs1znA7B8mOo4jUx7OtKGcQEl:Z0v4mUWKh9ctgC1RGnKymV44ShC7+quQ

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre
Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

1280 szgfw.exe
Loads dropped DLL 2 IoCs

Processes:

cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe

pid process

2228 cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
2228 cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1280	szgfw.exe

pid	process
2228	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
2228	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe

description	pid	process	target process
PID 2228 wrote to memory of 1280	2228	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	szgfw.exe
PID 2228 wrote to memory of 1280	2228	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	szgfw.exe
PID 2228 wrote to memory of 1280	2228	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	szgfw.exe
PID 2228 wrote to memory of 1280	2228	cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe
"C:\Users\Admin\AppData\Local\Temp\cbfda5d2b834b5ab42b38331eeb18f09825299edaae48ff29ee63a70c732b08f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:1280

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
5KB

MD5
9c96c96943b871b60db12e24ace5a202

SHA1
079a8bdd926217872b86a6ac56d5c5d78cb21e8f

SHA256
138df5d6b0c48eff82e0d0e79874364994303b19c31b42654831cdedc3f9583f

SHA512
5f8cd10aba01da5b483090332ff40710c07bffc3e8ba4c520abb7ecae5dcd0c7cc414e607b2eaec97748b6aad464d0d2fc7edcf0c5ae6032245e12befb6b3d33

Download Submit