upatre | 313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe
Size

24KB
MD5

cf32e14cd6b3093c4f60fc7264362d71
SHA1

614e12457ee77e0de55d67420b832f53a32f5382
SHA256

313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4
SHA512

fa3bed0be2d5f380f18ca040b6d1cff9762046ef6eed1dcbf4b5a1b6e4834a4f400019fd85e1c3c89f9a0c07cfdfcebea8cb9807560164fa21249223b19dfe9b
SSDEEP

384:bK+xKfzQ2XFpOQGR9zos2clAKLHRN74u56/R9zZwu990R:W+xAUiXOQ69zbjlAAX5e9zIR

Score

10^/10

upatre downloader

Malware Config

Signatures

Upatre
Upatre is a generic malware downloader.
downloader upatre

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe

Executes dropped EXE 1 IoCs

Processes:

szgfw.exe

pid process

764 szgfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
764	szgfw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe

description	pid	process	target process
PID 2164 wrote to memory of 764	2164	313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe	szgfw.exe
PID 2164 wrote to memory of 764	2164	313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe	szgfw.exe
PID 2164 wrote to memory of 764	2164	313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe	szgfw.exe

C:\Users\Admin\AppData\Local\Temp\313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe
"C:\Users\Admin\AppData\Local\Temp\313eb45125635fb251f114cdeec72ecd38d76a71807048e4a907d5f0882adac4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2164

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
"C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
2⤵
- Executes dropped EXE
PID:764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\szgfw.exe
Filesize
25KB

MD5
47d8e3c881855d26e06fe9f1ffd2bbbb

SHA1
28e1618035ca47673cb91a63f6cc32c998f98fcf

SHA256
690e41f33255599f916e6d032010fd1162e9056b6b7b3837d4ec17f1e2be42a3

SHA512
d43881d32e6f6ea256c8f98832ab466db7a45492077445cdc12c3a471497d820e053ced65b659fa4586a5221e6c0725ba4ea2849e997766ee6734d467d7360f1

Download Submit