Behavioral task
behavioral1
Sample
1752-141-0x0000000003F00000-0x00000000046D8000-memory.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1752-141-0x0000000003F00000-0x00000000046D8000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1752-141-0x0000000003F00000-0x00000000046D8000-memory.dmp
-
Size
7.8MB
-
MD5
b9938201c289447030a81d2acf116d46
-
SHA1
1f73a7b74b228f3221e3f9bb7acf821bfbd783c9
-
SHA256
20ec43177fcdee0c41b3acc6d73c89868494026efe26063bcf876aef3929ab5f
-
SHA512
e5c4d6a036d1db1f4e268a0726ba13f91cc042fdf03e0882520699a2677cd60e6e57439676bd498320e75d72f7594eb639a71316d544a8c9fa444c83cb3938c8
-
SSDEEP
196608:hLMlzenHIWjwwZdNE+eLCJxpSsqF10P1CPwDvt3uFTDC7LIKcosI3jhMSN:+Ojw2q+eWrpSfF1s1CPwDvt3uF/CfIKF
Malware Config
Extracted
privateloader
http://108.174.200.11/MWTSL
Signatures
-
Privateloader family
Files
-
1752-141-0x0000000003F00000-0x00000000046D8000-memory.dmp.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 154KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ