Overview

overview

10

Static

static

7

SecuriteIn...56.exe

windows7-x64

9

SecuriteIn...56.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2023 10:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.64662634.30711.13556.exe

  • Size

    3.9MB

  • MD5

    fc9eaee53296ad6fa5994952aa070110

  • SHA1

    a575e56b486486fbb696df8f8b3403e6ec266344

  • SHA256

    7acc9b90cf11c071880a627ef389107d55f2cbc845c52d5f265e5b2855d6a575

  • SHA512

    b268c6124cf09fa1202fe428fa8d0e5bdd543c42523323a79e24236187842171f6d17acb5f02de5b8c6dfb0d2a949c98b88e7e186832516be878aef6aee1ecc1

  • SSDEEP

    98304:FXePazT+6i8quQA7Yb+jWe4Cfrwq6l0D7PaidBZcFz+mpJu6J:FXOai8qREYbyhpjR6lSR26C3

Score
10/10
privateloaderevasionloadermainthemidatrojan

Malware Config

Extracted

Family

privateloader

C2

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

208.67.104.60
Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://193.56.146.76/Proxytest.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://privacy-tools-for-you-780.com/downloads/toolspab3.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe

    http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe

    https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp

    http://185.215.113.208/ferrari.exe

    https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://mnbuiy.pw/adsli/note8876.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe

    http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe

    https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.64662634.30711.13556.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.64662634.30711.13556.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:3204
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
          PID:1928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          PID:3560
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
        1⤵
          PID:4772
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
          1⤵
            PID:4760
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k netsvcs -p
            1⤵
            • Drops file in System32 directory
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:5008

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Virtualization/Sandbox Evasion

          1
          T1497

          Credential Access

          Discovery

          Query Registry

          4
          T1012

          Virtualization/Sandbox Evasion

          1
          T1497

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1404-145-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmp
            Filesize

            10.8MB

            Download
          • memory/1404-144-0x00000000009E0000-0x0000000001548000-memory.dmp
            Filesize

            11.4MB

            Download
          • memory/1404-135-0x00007FFD8B1F0000-0x00007FFD8B3E5000-memory.dmp
            Filesize

            2.0MB

            Download
          • memory/1404-136-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmp
            Filesize

            10.8MB

            Download
          • memory/1404-132-0x00000000009E0000-0x0000000001548000-memory.dmp
            Filesize

            11.4MB

            Download
          • memory/1404-138-0x00007FFD8B1F0000-0x00007FFD8B3E5000-memory.dmp
            Filesize

            2.0MB

            Download
          • memory/1404-134-0x00000000009E0000-0x0000000001548000-memory.dmp
            Filesize

            11.4MB

            Download
          • memory/1404-139-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmp
            Filesize

            10.8MB

            Download
          • memory/1404-137-0x00000000009E0000-0x0000000001548000-memory.dmp
            Filesize

            11.4MB

            Download
          • memory/1404-142-0x00007FFD8B1F0000-0x00007FFD8B3E5000-memory.dmp
            Filesize

            2.0MB

            Download
          • memory/3560-141-0x00000000005D88A2-mapping.dmp
            Download
          • memory/3560-143-0x0000000000400000-0x0000000000655000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/3560-140-0x0000000000400000-0x0000000000655000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/3560-146-0x0000000000400000-0x0000000000655000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/3560-147-0x0000000000400000-0x0000000000655000-memory.dmp
            Filesize

            2.3MB

            Download
          • memory/3560-148-0x0000000000400000-0x0000000000655000-memory.dmp
            Filesize

            2.3MB

            Download