Overview

overview

10

Static

static

e8fe5a28d0...a4.exe

windows7-x64

10

e8fe5a28d0...a4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 10:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e8fe5a28d052a908573b49ab0a904ca4.exe

  • Size

    275KB

  • MD5

    e8fe5a28d052a908573b49ab0a904ca4

  • SHA1

    b52db9d39d4ceefedb5c97c2e11bef69c93850d7

  • SHA256

    7a62836c8967ef6d3c737f9aba146eb7ef5d08cacc564faaa2699efac7561b97

  • SHA512

    513a851dd247b81e1ff7b6d1ec07ca896571e5d739afbcd756c50ba3f0857fd760e7c60264d0e2b9d12a60c5dedcc3625360d916e4449d20a93ccf44f941995f

Score
10/10
privateloaderloader

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://85.202.169.116/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

85.202.169.116

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8fe5a28d052a908573b49ab0a904ca4.exe
    "C:\Users\Admin\AppData\Local\Temp\e8fe5a28d052a908573b49ab0a904ca4.exe"
    1⤵
      PID:1560
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 648
        2⤵
        • Program crash
        PID:2388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1560 -ip 1560
      1⤵
        PID:1880

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1560-130-0x000000000050E000-0x000000000052C000-memory.dmp
        Filesize

        120KB

        Download
      • memory/1560-131-0x00000000021E0000-0x0000000002215000-memory.dmp
        Filesize

        212KB

        Download
      • memory/1560-132-0x0000000000400000-0x000000000044D000-memory.dmp
        Filesize

        308KB

        Download
      • memory/1560-133-0x0000000000400000-0x000000000044D000-memory.dmp
        Filesize

        308KB

        Download
      • memory/1560-134-0x0000000000400000-0x000000000044D000-memory.dmp
        Filesize

        308KB

        Download