Resubmissions
07-02-2023 08:18
230207-j7fb8sad74 1017-07-2022 06:07
220717-gvcdpshcej 1020-05-2022 06:00
220520-gqsvwsdbc8 1020-05-2022 05:59
220520-gpw6xsdaf3 1Analysis
-
max time kernel
256s -
max time network
259s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-es -
resource tags
arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
07-02-2023 08:18
Errors
General
-
Target
Setup.exe
-
Size
523KB
-
MD5
329acf4d6a5e735c1fd3b3fc6c77d3f3
-
SHA1
932598a6dbd5eaa0bd7b2aabd16f9c5fab62d960
-
SHA256
ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
-
SHA512
1c4b78f03238bd6e01abd14794c78ab5a27daf32c6a7237e814740f81c5892f4353f1145c71ad4fd1c57f5675a2281645de3fa437d78c05d5cc24c02f41cf4b5
-
SSDEEP
12288:v0Go57lOzaCdlwVnu/h2gPoxntMRWru3Yo6T9XPF1:v0Gm7lOmC6gPoxntMQru3YLRn
Malware Config
Extracted
privateloader
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
-
payload_url
https://cdn.discordapp.com/attachments/1003879548242374749/1003976870611669043/NiceProcessX64.bmp
https://cdn.discordapp.com/attachments/1003879548242374749/1003976754358124554/NiceProcessX32.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
Signatures
-
Processes:
Setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection Setup.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 38 ipinfo.io 39 ipinfo.io -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exeSetup.exepid process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4900 Setup.exe 4900 Setup.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4248 taskmgr.exe Token: SeSystemProfilePrivilege 4248 taskmgr.exe Token: SeCreateGlobalPrivilege 4248 taskmgr.exe Token: 33 4248 taskmgr.exe Token: SeIncBasePriorityPrivilege 4248 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 2032 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b4855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\CatRootMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System32\MicrosoftMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4900-132-0x0000000003FE0000-0x0000000004234000-memory.dmpFilesize
2.3MB
-
memory/4900-133-0x0000000003FE0000-0x0000000004234000-memory.dmpFilesize
2.3MB
-
memory/4900-134-0x0000000003FE0000-0x0000000004234000-memory.dmpFilesize
2.3MB