privateloader | 0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Size

2.8MB
MD5

614a3b04cdcd3e06426e9de4349b104c
SHA1

520b4007d12b1a2398a763991610c6604ec2ad83
SHA256

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a
SHA512

4e8e00ca9d239c66891c98e7c5c67a4523e0b06edc3fb74212ebc0dc5ac1bcdb806425cee59e490356807cf5748fa7577c662a9e8031ecac7f02d31804126c4c

Score

10^/10

privateloader evasion loader main spyware stealer themida trojan

Malware Config

Extracted

Family

privateloader

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes

payload_url
http://193.233.177.215/download/NiceProcessX64.bmp

http://193.233.177.215/download/NiceProcessX32.bmp

https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp

https://c.xyzgamec.com/userdown/2202/random.exe

http://193.56.146.76/Proxytest.exe

http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

http://privacy-tools-for-you-780.com/downloads/toolspab3.exe

http://luminati-china.xyz/aman/casper2.exe

https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe

http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe

https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp

https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp

https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp

http://185.215.113.208/ferrari.exe

https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp

https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp

https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp

https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp

https://c.xyzgamec.com/userdown/2202/random.exe

http://mnbuiy.pw/adsli/note8876.exe

http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

http://luminati-china.xyz/aman/casper2.exe

https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe

http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe

https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe

https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe

https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe

https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe

https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

nWxLGq91Mxdfg6TkAng9TFGS.exe

pid process

1372 nWxLGq91Mxdfg6TkAng9TFGS.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

pid	process
1372	nWxLGq91Mxdfg6TkAng9TFGS.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Control Panel\International\Geo\Nation	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

Loads dropped DLL 1 IoCs

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

pid process

1108 0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1108-55-0x0000000000220000-0x00000000004FB000-memory.dmp	themida
behavioral1/memory/1108-56-0x0000000000220000-0x00000000004FB000-memory.dmp	themida
behavioral1/memory/1108-57-0x0000000000220000-0x00000000004FB000-memory.dmp	themida
behavioral1/memory/1108-59-0x0000000000220000-0x00000000004FB000-memory.dmp	themida
behavioral1/memory/1108-60-0x0000000000220000-0x00000000004FB000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ipinfo.io
18 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

pid process

1108 0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
17	ipinfo.io
18	ipinfo.io

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

pid	process
1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe

description	pid	process	target process
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe
PID 1108 wrote to memory of 1372	1108	0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe	nWxLGq91Mxdfg6TkAng9TFGS.exe

C:\Users\Admin\AppData\Local\Temp\0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe
"C:\Users\Admin\AppData\Local\Temp\0432fa9a068b9dda73edec2a4b05b972ee68589bad7d9470d89e73b08f1f533a.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\Pictures\Adobe Films\nWxLGq91Mxdfg6TkAng9TFGS.exe
"C:\Users\Admin\Pictures\Adobe Films\nWxLGq91Mxdfg6TkAng9TFGS.exe"
2⤵
- Executes dropped EXE
PID:1372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pictures\Adobe Films\nWxLGq91Mxdfg6TkAng9TFGS.exe
Filesize
457KB

MD5
dbe19cadd98efde1d5d7e2d18685893f

SHA1
a1cd5e3fd2d32515475021406da772992e984e86

SHA256
5396272ba07876d97be28453f7231abb3e593235c9f663fe617376619c39d6e4

SHA512
2c14fed3f2b337d0bd25ca03b7634bc4156fe89342c4ebbe91dbc0dd909723f4ddd6235a9009a547530fc77607a3c3c282ab36cfe3c91157dacc503286e7a20e

Download Submit
C:\Users\Admin\Pictures\Adobe Films\nWxLGq91Mxdfg6TkAng9TFGS.exe
Filesize
457KB

MD5
dbe19cadd98efde1d5d7e2d18685893f

SHA1
a1cd5e3fd2d32515475021406da772992e984e86

SHA256
5396272ba07876d97be28453f7231abb3e593235c9f663fe617376619c39d6e4

SHA512
2c14fed3f2b337d0bd25ca03b7634bc4156fe89342c4ebbe91dbc0dd909723f4ddd6235a9009a547530fc77607a3c3c282ab36cfe3c91157dacc503286e7a20e

Download Submit
\Users\Admin\Pictures\Adobe Films\nWxLGq91Mxdfg6TkAng9TFGS.exe
Filesize
457KB

MD5
dbe19cadd98efde1d5d7e2d18685893f

SHA1
a1cd5e3fd2d32515475021406da772992e984e86

SHA256
5396272ba07876d97be28453f7231abb3e593235c9f663fe617376619c39d6e4

SHA512
2c14fed3f2b337d0bd25ca03b7634bc4156fe89342c4ebbe91dbc0dd909723f4ddd6235a9009a547530fc77607a3c3c282ab36cfe3c91157dacc503286e7a20e

Download Submit
memory/1108-57-0x0000000000220000-0x00000000004FB000-memory.dmp

Filesize
2.9MB

Download
memory/1108-58-0x0000000077560000-0x00000000776E0000-memory.dmp

Filesize
1.5MB

Download
memory/1108-59-0x0000000000220000-0x00000000004FB000-memory.dmp

Filesize
2.9MB

Download
memory/1108-60-0x0000000000220000-0x00000000004FB000-memory.dmp

Filesize
2.9MB

Download
memory/1108-61-0x0000000004350000-0x00000000045A3000-memory.dmp

Filesize
2.3MB

Download
memory/1108-62-0x0000000004350000-0x00000000045A3000-memory.dmp

Filesize
2.3MB

Download
memory/1108-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1108-56-0x0000000000220000-0x00000000004FB000-memory.dmp

Filesize
2.9MB

Download
memory/1108-55-0x0000000000220000-0x00000000004FB000-memory.dmp

Filesize
2.9MB

Download
memory/1372-64-0x0000000000000000-mapping.dmp

Download