Analysis
-
max time kernel
64s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-01-2023 20:37
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Install.exe
Resource
win10v2004-20220812-en
General
-
Target
Install.exe
-
Size
735.3MB
-
MD5
f2b49ceea3013512f24008455c8ebbfb
-
SHA1
4ca2531a0c43309b4029ba74540317548da9d461
-
SHA256
1ce7365e962ceda771c49c5f3ac373c8befc07f29d632816c6bfbea22e5dbfe4
-
SHA512
32ae2176d12da1c8bd446fc785e3c2ad7cefd42a587c875ebbc27451136b08dd6b9ca1dc6e376fb96361caa2d3d37b25e634e375788121922d53e330e8699df3
-
SSDEEP
98304:WVP/KBE21lMdByvPKSpB4t2VXSD1TwF7t9VM8hoA:aHKBtrKSpBmIXSD18p9Y
Malware Config
Extracted
privateloader
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
208.67.104.60
-
payload_url
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 ipinfo.io 10 ipinfo.io -
Drops file in System32 directory 4 IoCs
Processes:
jsc.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy jsc.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini jsc.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol jsc.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI jsc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Install.exedescription pid process target process PID 1224 set thread context of 1740 1224 Install.exe jsc.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
jsc.exetaskmgr.exepid process 1740 jsc.exe 1740 jsc.exe 1740 jsc.exe 1740 jsc.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1000 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1000 taskmgr.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
Processes:
taskmgr.exepid process 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
Processes:
taskmgr.exepid process 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe 1000 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Install.exedescription pid process target process PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe PID 1224 wrote to memory of 1740 1224 Install.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-63-0x000007FEFC581000-0x000007FEFC583000-memory.dmpFilesize
8KB
-
memory/1000-64-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1000-65-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1000-66-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1224-54-0x0000000000C90000-0x000000000102C000-memory.dmpFilesize
3.6MB
-
memory/1224-55-0x000000001B670000-0x000000001B912000-memory.dmpFilesize
2.6MB
-
memory/1740-56-0x0000000000400000-0x0000000000663000-memory.dmpFilesize
2.4MB
-
memory/1740-57-0x00000000005D88A2-mapping.dmp
-
memory/1740-59-0x0000000076711000-0x0000000076713000-memory.dmpFilesize
8KB
-
memory/1740-60-0x0000000000400000-0x0000000000663000-memory.dmpFilesize
2.4MB
-
memory/1740-61-0x0000000000400000-0x0000000000663000-memory.dmpFilesize
2.4MB
-
memory/1740-62-0x0000000000400000-0x0000000000663000-memory.dmpFilesize
2.4MB