Overview

overview

10

Static

static

Install.exe

windows7-x64

10

Install.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    85s
  • max time network
    95s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Install.exe

  • Size

    679.0MB

  • MD5

    d0dee3aac6a71aa9e9e4fc6e411574f0

  • SHA1

    bb8446460a77e3b57efb3e6d0e9714ab5bf1ddf6

  • SHA256

    aa37e35b0e18bd878d26854cb434a7a3e9447a576cfb0fd2002762f2d8907fda

  • SHA512

    d0a9677372909afb7441aa351da32f62c2f59e081d76de2f3b8d318fb02d5c4534ff46cb7ae326e8547743416ac6cf8746c2b1399d5f737c1a35c2b8a3c66394

  • SSDEEP

    98304:9jTrY/axAte0Lh4VswwO1He5+o36XLz/G3nuF2PmGwzkSLEXHdzjf+:V8deq4V7He5+aCzbQPwzs3BjW

Score
10/10
privateloaderloaderspywarestealer

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1460-54-0x0000000075981000-0x0000000075983000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1460-55-0x0000000001360000-0x0000000001D0E000-memory.dmp
    Filesize

    9.7MB

    Download