Analysis
-
max time kernel
147s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2023 07:54
Static task
static1
Behavioral task
behavioral1
Sample
File.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
File.exe
Resource
win10v2004-20230220-en
General
-
Target
File.exe
-
Size
655.0MB
-
MD5
4eb9b0f0903b77be9247978ffbc8814f
-
SHA1
ea21fa7fd9a430a899a67136b6f864bbd6ea74b9
-
SHA256
ba88907898f51ddf30595e773cd5de0f28020ad70af49e530c89b20501bc0f94
-
SHA512
fec3dec02889784e2aa6e82f64f85e397ce44812287312809081e299aca960ac03cc23dbccc43e72c621a05b80de1a6bbce04003d0538708e9a45fe5d74e8a1f
-
SSDEEP
98304:Jkfy48U0RHYuMH+F4mMURdns7gefj/vIeZuNYq8CIF+k/SL7IwXdz:Jka4t0/s7gefrvENhuwaSYU
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io 4 ipinfo.io 8 api.db-ip.com 9 api.db-ip.com -
Drops file in System32 directory 4 IoCs
Processes:
File.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy File.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini File.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol File.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI File.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1936 928 WerFault.exe File.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
File.exedescription pid process target process PID 928 wrote to memory of 1936 928 File.exe WerFault.exe PID 928 wrote to memory of 1936 928 File.exe WerFault.exe PID 928 wrote to memory of 1936 928 File.exe WerFault.exe PID 928 wrote to memory of 1936 928 File.exe WerFault.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/928-54-0x0000000000400000-0x0000000000EB6000-memory.dmpFilesize
10.7MB
-
memory/928-56-0x0000000000400000-0x0000000000EB6000-memory.dmpFilesize
10.7MB
-
memory/928-57-0x0000000000400000-0x0000000000EB6000-memory.dmpFilesize
10.7MB
-
memory/928-67-0x0000000000400000-0x0000000000EB6000-memory.dmpFilesize
10.7MB