Overview

overview

10

Static

static

3

46c440527c...cs.exe

windows7-x64

10

46c440527c...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe

  • Size

    4KB

  • MD5

    46c440527c7d4395372773dc8c54bd80

  • SHA1

    65f006375e3d65379df3c1627ce267f8d987ffe7

  • SHA256

    f9f30c96e8beef5d7d0968989a136fedaccab715e97285300288e772b04ddf93

  • SHA512

    4a8edca21b8b8fd98294724171b150a5535803c1f3a870d62460d554448d86401e430089031d11548e4e9ee7f8e7fd3c1063dae404d0e701e5e37b99e1e1b8eb

  • SSDEEP

    48:Zdni+Wyi18DN0nCvTaE6nc9fhXcGEY3sJd9ga91Rs1lnA7B8mOo4jUx7OtKGc3IS:Z0v4mUWKh9ctgC1RUnKymV44ShiD

Score
10/10
upatredownloader

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

    downloaderupatre
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\46c440527c7d4395372773dc8c54bd80_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
    Filesize

    4KB

    MD5

    3de0c64336d613bdd742aa8cf52beb0b

    SHA1

    052525f5ce70b305b00d97b172835ce0cad52d37

    SHA256

    62d89ec0b4be408b1cb933e0eda1697f6300c0d28baed696c013c613d1bd9c3b

    SHA512

    68f1b23095ab3bd3fde5ab3f81ea395d3e2448482014c72fe6f464015eaf4a844013f63d23f98bec1b46e0d76386ec74228122b62039ac32f707e5518a324605

    Download Submit