privateloader | edd4c28b27289b8154d0cb6a487abef68f79087f554b02eace45e4ee8dd95325

General

Target

file.exe
Size

4.0MB
MD5

4879c56a17e0a0870e2b516b1c692509
SHA1

e4c12cc04b9405233628a71a8accf158e285aad6
SHA256

edd4c28b27289b8154d0cb6a487abef68f79087f554b02eace45e4ee8dd95325
SHA512

8aa8de09b36ec5c979a56f69b67cb95e8b7287078ad79ce5a3af8425e494dcfe3befb7e19270be29af982a2ab46fc32554a2561927b8164572f606e3a7310747
SSDEEP

98304:c6LMazMnUrV8xRyGguqPW7YBshTe5WepB:xHMUrVuyGgLPLBIKRpB

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1496 set thread context of 576 1496 file.exe SetupUtility.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

868 576 WerFault.exe SetupUtility.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

file.exe

pid process

1496 file.exe
1496 file.exe
1496 file.exe
1496 file.exe
1496 file.exe
1496 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1496 file.exe

description	pid	process	target process
PID 1496 set thread context of 576	1496	file.exe	SetupUtility.exe

pid	pid_target	process	target process
868	576	WerFault.exe	SetupUtility.exe

pid	process
1496	file.exe
1496	file.exe
1496	file.exe
1496	file.exe
1496	file.exe
1496	file.exe

description	pid	process
Token: SeDebugPrivilege	1496	file.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

file.exeSetupUtility.exe

description	pid	process	target process
PID 1496 wrote to memory of 276	1496	file.exe	regtlibv12.exe
PID 1496 wrote to memory of 276	1496	file.exe	regtlibv12.exe
PID 1496 wrote to memory of 276	1496	file.exe	regtlibv12.exe
PID 1496 wrote to memory of 1376	1496	file.exe	jsc.exe
PID 1496 wrote to memory of 1376	1496	file.exe	jsc.exe
PID 1496 wrote to memory of 1376	1496	file.exe	jsc.exe
PID 1496 wrote to memory of 1376	1496	file.exe	jsc.exe
PID 1496 wrote to memory of 1360	1496	file.exe	AddInUtil.exe
PID 1496 wrote to memory of 1360	1496	file.exe	AddInUtil.exe
PID 1496 wrote to memory of 1360	1496	file.exe	AddInUtil.exe
PID 1496 wrote to memory of 284	1496	file.exe	ngen.exe
PID 1496 wrote to memory of 284	1496	file.exe	ngen.exe
PID 1496 wrote to memory of 284	1496	file.exe	ngen.exe
PID 1496 wrote to memory of 296	1496	file.exe	aspnet_regiis.exe
PID 1496 wrote to memory of 296	1496	file.exe	aspnet_regiis.exe
PID 1496 wrote to memory of 296	1496	file.exe	aspnet_regiis.exe
PID 1496 wrote to memory of 1276	1496	file.exe	mscorsvw.exe
PID 1496 wrote to memory of 1276	1496	file.exe	mscorsvw.exe
PID 1496 wrote to memory of 1276	1496	file.exe	mscorsvw.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 1496 wrote to memory of 576	1496	file.exe	SetupUtility.exe
PID 576 wrote to memory of 868	576	SetupUtility.exe	WerFault.exe
PID 576 wrote to memory of 868	576	SetupUtility.exe	WerFault.exe
PID 576 wrote to memory of 868	576	SetupUtility.exe	WerFault.exe
PID 576 wrote to memory of 868	576	SetupUtility.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
2⤵
PID:276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:1376

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
2⤵
PID:1360

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
2⤵
PID:284

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
2⤵
PID:296

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:1276

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 168
3⤵
- Program crash
PID:868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-56-0x0000000000400000-0x000000000079E000-memory.dmp

Filesize
3.6MB

Download
memory/576-57-0x000000000045F69C-mapping.dmp

Download
memory/576-58-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/868-59-0x0000000000000000-mapping.dmp

Download
memory/1496-54-0x0000000000A60000-0x0000000000E68000-memory.dmp

Filesize
4.0MB

Download
memory/1496-55-0x000000001B4A0000-0x000000001B87E000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads