Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://speedwell.co...

windows10-2004-x64

10

Analysis

  • max time kernel
    17s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2023 03:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://speedwell.com.bd/download/Install_pass1234.7z

Score
10/10
privateloaderloadermain

Malware Config

Extracted

Family

privateloader

C2

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

45.15.156.229

85.208.136.10

94.131.106.196

5.181.80.133

94.142.138.131

94.142.138.113

208.67.104.60
Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://193.56.146.76/Proxytest.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://privacy-tools-for-you-780.com/downloads/toolspab3.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe

    http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe

    https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp

    http://185.215.113.208/ferrari.exe

    https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp

    https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp

    https://c.xyzgamec.com/userdown/2202/random.exe

    http://mnbuiy.pw/adsli/note8876.exe

    http://www.yzsyjyjh.com/askhelp23/askinstall23.exe

    http://luminati-china.xyz/aman/casper2.exe

    https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe

    http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe

    https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe

    https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe

    https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://speedwell.com.bd/download/Install_pass1234.7z
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4128
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Install_pass1234\" -spe -an -ai#7zMap21655:88:7zEvent15299
    1⤵
      PID:4368
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:820
      • C:\Users\Admin\Desktop\Install_pass1234\Install.exe
        "C:\Users\Admin\Desktop\Install_pass1234\Install.exe"
        1⤵
          PID:4256
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
          1⤵
            PID:4012
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
            1⤵
              PID:3900

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\Install_pass1234[1].7z
              Filesize

              5.0MB

              MD5

              32e0ddc0e3205817e4e2fecc5c7fd6aa

              SHA1

              09e2fac5accb0668429b99a482331dffb3ab9012

              SHA256

              1ebe1165bd9fcb741013519ca64642b7585574cb7eb74138ee25640c72538642

              SHA512

              125464901a14d840fd3527dc3c955cd199a4eccc801326e3125079bc2f8aed3f24595f6bddc0f03b3211f9a03adf27cc422b34cb77a160558e62d7d8e8aa99cf

              Download Submit
            • C:\Users\Admin\Desktop\Install_pass1234.7z.14vi5ad.partial
              Filesize

              5.0MB

              MD5

              32e0ddc0e3205817e4e2fecc5c7fd6aa

              SHA1

              09e2fac5accb0668429b99a482331dffb3ab9012

              SHA256

              1ebe1165bd9fcb741013519ca64642b7585574cb7eb74138ee25640c72538642

              SHA512

              125464901a14d840fd3527dc3c955cd199a4eccc801326e3125079bc2f8aed3f24595f6bddc0f03b3211f9a03adf27cc422b34cb77a160558e62d7d8e8aa99cf

              Download Submit
            • C:\Users\Admin\Desktop\Install_pass1234\Install.exe
              Filesize

              613.6MB

              MD5

              f59410b0fd928d62dc966b46284e2c40

              SHA1

              29ada558c9b800933e5f25f194d5d2886cdc942e

              SHA256

              e116660f0480d15bdde28f7f0751211493597e73e49537afc66538b36dfabb60

              SHA512

              8d1760c25e4bef7fcc2936fca043c0cbb26260c80ab2120a5b47c394053f33008e5bf212df4ff25262efa4922ddd64edbaa9b9ba8939846db7cb192c052c943c

              Download Submit
            • C:\Users\Admin\Desktop\Install_pass1234\Install.exe
              Filesize

              616.2MB

              MD5

              40271d62b26012959ad506bdd8f95711

              SHA1

              9aa20893ad857624903cb764b4586330f5588802

              SHA256

              249d5d8143ae32ec6cff6dc60ae961fac807c6651378717b04b82c01e0021ed2

              SHA512

              c959a3ea1ee75f25375338c620000cf8fbe556d92d742497cdbb0063f5b25513e93cf534966f0a998239fe98ad409f7962ab852570075c731622026ed4817f06

              Download Submit
            • memory/4256-153-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download
            • memory/4256-154-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download
            • memory/4256-155-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download
            • memory/4256-157-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download
            • memory/4256-158-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download
            • memory/4256-178-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download
            • memory/4256-179-0x0000000000400000-0x0000000000EB7000-memory.dmp
              Filesize

              10.7MB

              Download