Overview

overview

10

Static

static

Install.exe

windows7-x64

10

Install.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    177s
  • max time network
    215s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Install.exe

  • Size

    679.0MB

  • MD5

    d0dee3aac6a71aa9e9e4fc6e411574f0

  • SHA1

    bb8446460a77e3b57efb3e6d0e9714ab5bf1ddf6

  • SHA256

    aa37e35b0e18bd878d26854cb434a7a3e9447a576cfb0fd2002762f2d8907fda

  • SHA512

    d0a9677372909afb7441aa351da32f62c2f59e081d76de2f3b8d318fb02d5c4534ff46cb7ae326e8547743416ac6cf8746c2b1399d5f737c1a35c2b8a3c66394

  • SSDEEP

    98304:9jTrY/axAte0Lh4VswwO1He5+o36XLz/G3nuF2PmGwzkSLEXHdzjf+:V8deq4V7He5+aCzbQPwzs3BjW

Score
10/10
privateloaderloaderspywarestealer

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:224
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:372
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:1976

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/224-132-0x0000000000580000-0x0000000000F2E000-memory.dmp
        Filesize

        9.7MB

        Download