privateloader | 2f0e6ce173826a0d6e845b24aeda3d32f121da10dc18be08b312d73ef2dc2ae8

Analysis

max time kernel
299s
max time network
383s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 20:10

Target

8C16C69CBF9006458D6CD7F3D7FABEE0.exe
Size

4.7MB
MD5

8c16c69cbf9006458d6cd7f3d7fabee0
SHA1

9c4f3dfdcccd8232c470a5abd5ef5370af09a54a
SHA256

2f0e6ce173826a0d6e845b24aeda3d32f121da10dc18be08b312d73ef2dc2ae8
SHA512

4346fa48fb070a1ad1ef0ede3728d0a862e47a219b8c7d7710c73e2f5a6ac196f02fbfd33d91aa84a26f90887ba3892cca63d550c65f84b637de5cf5845fb266
SSDEEP

98304:eBOtDXshWdPBJxurSS8EWNeGpp3/H5KoWipmClrL/fLNLOHwUVaz:qOtDXUu5JAwheGp9/ZK0pmCBzwQ9z

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

64 ipinfo.io
63 ipinfo.io

flow	ioc
64	ipinfo.io
63	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

8C16C69CBF9006458D6CD7F3D7FABEE0.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8C16C69CBF9006458D6CD7F3D7FABEE0.exe
File opened for modification	C:\Windows\System32\GroupPolicy	8C16C69CBF9006458D6CD7F3D7FABEE0.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8C16C69CBF9006458D6CD7F3D7FABEE0.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8C16C69CBF9006458D6CD7F3D7FABEE0.exe

C:\Users\Admin\AppData\Local\Temp\8C16C69CBF9006458D6CD7F3D7FABEE0.exe
"C:\Users\Admin\AppData\Local\Temp\8C16C69CBF9006458D6CD7F3D7FABEE0.exe"
1⤵
- Drops file in System32 directory
PID:4440

memory/4440-132-0x0000000000860000-0x0000000001141000-memory.dmp

Filesize
8.9MB

Download