Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2023 08:15
Static task
static1
Behavioral task
behavioral1
Sample
File.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
File.exe
Resource
win10v2004-20230221-en
General
-
Target
File.exe
-
Size
657.0MB
-
MD5
701370ad2956742ba3404f198fb5c2ae
-
SHA1
c213acdb11eaa7764584ee85065ba36a1497ee29
-
SHA256
03541d7c87bbf23c619382841be849de98beaf0d465b933b093400d398212ba9
-
SHA512
95e56faee0cbe739b5499c338824979a34204951b68c1f24408cd607a0c71cf8e9dfd2fe0678fc5b822799fa308cd1e688556027a1b5c5c336bdd57e7b1c2a4b
-
SSDEEP
98304:8+b8eCtkPFRZUoNDMn2Jv9dNDMLKpD9vp/LJIhx82uaZkSpEIJeA:UeMCRRNH9dFgo9vhL12uaZ5J
Malware Config
Extracted
privateloader
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
45.15.156.229
85.208.136.10
94.131.106.196
5.181.80.133
94.142.138.131
94.142.138.113
208.67.104.60
-
payload_url
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io 4 ipinfo.io 8 api.db-ip.com 9 api.db-ip.com -
Drops file in System32 directory 4 IoCs
Processes:
File.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy File.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini File.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol File.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI File.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 860 1748 WerFault.exe File.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
File.exedescription pid process target process PID 1748 wrote to memory of 860 1748 File.exe WerFault.exe PID 1748 wrote to memory of 860 1748 File.exe WerFault.exe PID 1748 wrote to memory of 860 1748 File.exe WerFault.exe PID 1748 wrote to memory of 860 1748 File.exe WerFault.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1748-54-0x0000000000400000-0x0000000000EA0000-memory.dmpFilesize
10.6MB
-
memory/1748-56-0x0000000000400000-0x0000000000EA0000-memory.dmpFilesize
10.6MB
-
memory/1748-57-0x0000000000400000-0x0000000000EA0000-memory.dmpFilesize
10.6MB
-
memory/1748-67-0x0000000000400000-0x0000000000EA0000-memory.dmpFilesize
10.6MB
-
memory/1748-76-0x0000000000400000-0x0000000000EA0000-memory.dmpFilesize
10.6MB