privateloader | b0b206e8239e1e93f5c3cbedb8a25b585d5f7d148524fbdbbfc8085cc26f1ca5 | Triage

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2023 15:04

Sharing

Report Analysis Logs

General

Target

file.exe
Size

6.5MB
MD5

38f000bacf037f9489db983e5e409da3
SHA1

8e5a3ba637324e9d06f4545c7b9e6ada234759e0
SHA256

b0b206e8239e1e93f5c3cbedb8a25b585d5f7d148524fbdbbfc8085cc26f1ca5
SHA512

4676262d372b7ef81744d96e3ce32b23e7c18a42b8b4e3eedbb29c2de36d1dad0f388fb45ae3739104f9d035da50f0a391e178b404d8d91eaf664fbc1fc3e5e5
SSDEEP

98304:deWcgHovCxfu+Na01KteIB2oiAdG0HewKwwg/0ohxYm9DoSCVLtisg8hj:Mtvg11eV2m/HeGwg89mJoBisvN

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Drops file in System32 directory 4 IoCs

Processes:

file.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	file.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	file.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	file.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	file.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3560 2072 WerFault.exe file.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

2072 file.exe
2072 file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 804
2⤵
- Program crash
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2072 -ip 2072
1⤵
PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-133-0x0000000001050000-0x0000000001051000-memory.dmp

Filesize
4KB

Download
memory/2072-134-0x0000000000400000-0x0000000000FCC000-memory.dmp

Filesize
11.8MB

Download