Overview

overview

10

Static

static

7

Install.exe

windows7-x64

7

Install.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    49s
  • max time network
    58s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2023 15:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Install.exe

  • Size

    654.0MB

  • MD5

    b02ddc562c43244674c596f272ba2cec

  • SHA1

    9a8b6e1f8146b8fc9b8f4e282c349ab489e5f780

  • SHA256

    55196b8016a6d8c41da9e66fbb3a9d4419ea6d6ba7496c1549a6a45025b6c44f

  • SHA512

    9cbeebce1534a1ed095961c102d490b9fa88ea81275baa5c4f7619b17e58f1fd46ab59bfe0704e600bf5328b88ef7a2fb8b5b4e630c5ab42a71aa3bcd33a5a44

  • SSDEEP

    98304:Iq37yMYRdfKP8m2dwkZIf+293hpeAOnqfjWvon2E/ngIeRqhI:I+PYjJzuCs+03beAmtont/JcqhI

Score
10/10
privateloaderloadervmprotect

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Drops file in System32 directory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    1⤵
    • Drops file in System32 directory
    PID:5108
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:2824
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:1280

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5108-133-0x0000000000B00000-0x0000000001D54000-memory.dmp
        Filesize

        18.3MB

        Download