privateloader | f50d423389237b317931741f174e060e84008850dd3f7d8deecf96438a95e1e6

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/03/2023, 10:55

Target

1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe
Size

4.7MB
MD5

fb67481e2ae37b3f0304048d15e76ba6
SHA1

035c005e34504bd0228feaf4b54eea743894b7aa
SHA256

1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17
SHA512

1e70cb639cff93f597553736899037b42ca61cca6af7e61c5e662d14010cc7c5f49efd949a5e997ac58766c46689c72e404717ea6562c1a71fc74d947cbcf006
SSDEEP

98304:faBDlNcMRYwhDlXn7/IZZkwFiXjM65m2UjVE7TmJyxaaWESfmYR:fgqmYQDlLQZZkwqI26DJsapR

Score

10^/10

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1620-54-0x0000000000390000-0x0000000000C94000-memory.dmp	vmprotect

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	1620	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 764	1620	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe	27
PID 1620 wrote to memory of 764	1620	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe	27
PID 1620 wrote to memory of 764	1620	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe	27
PID 1620 wrote to memory of 764	1620	1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe	27

C:\Users\Admin\AppData\Local\Temp\1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe
"C:\Users\Admin\AppData\Local\Temp\1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 952
  2⤵
  - Program crash
  PID:764

memory/1620-54-0x0000000000390000-0x0000000000C94000-memory.dmp

Filesize
9.0MB

Download