privateloader | 0d9d7b4f30989ab8a367a11d51971896ca2979bb5e9ad6c36d21493fdd0eab23

Analysis

max time kernel
67s
max time network
135s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-06-2023 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File.exe
Size

680.0MB
MD5

cd32bc27e4634e5dc2f6c36b1e4cfd48
SHA1

dfd36c9995a2a1d43818851f57ec9d267a7c1273
SHA256

fa23b455384d8ba175c41e3b671f3790d4313ddcf20beff02a3238210804d057
SHA512

dd5b79409bccfceea6c4d88aea62dfff8f043c7b3f56bf88cb6692fd006d84b893cba0dcb8dc59ff59cb98a0ba23884d6dce276226956b717ab71db184a4c44d
SSDEEP

98304:5C+rsvtritV2LJNo2p9RympVBjBTl7uQDz0oYzwfeiImh8RBsJaY4acsB6deoLLb:0+o1riT8JSTiz7Dz0ohfezRmtkKm

Score

10^/10

privateloader loader spyware stealer

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

File.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\Geo\Nation File.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ipinfo.io
4 ipinfo.io
8 api.db-ip.com
9 api.db-ip.com

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\Geo\Nation	File.exe

flow	ioc
3	ipinfo.io
4	ipinfo.io
8	api.db-ip.com
9	api.db-ip.com

Drops file in System32 directory 4 IoCs

Processes:

File.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	File.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	File.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

File.exe

pid process

1348 File.exe
1348 File.exe

pid	process
1348	File.exe
1348	File.exe

C:\Users\Admin\AppData\Local\Temp\File.exe
"C:\Users\Admin\AppData\Local\Temp\File.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-55-0x0000000077D70000-0x0000000077D72000-memory.dmp

Filesize
8KB

Download
memory/1348-54-0x0000000077D70000-0x0000000077D72000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000077D70000-0x0000000077D72000-memory.dmp

Filesize
8KB

Download
memory/1348-59-0x0000000077D80000-0x0000000077D82000-memory.dmp

Filesize
8KB

Download
memory/1348-58-0x0000000077D80000-0x0000000077D82000-memory.dmp

Filesize
8KB

Download
memory/1348-57-0x0000000077D80000-0x0000000077D82000-memory.dmp

Filesize
8KB

Download
memory/1348-62-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/1348-61-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/1348-60-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/1348-65-0x0000000077DA0000-0x0000000077DA2000-memory.dmp

Filesize
8KB

Download
memory/1348-64-0x0000000077DA0000-0x0000000077DA2000-memory.dmp

Filesize
8KB

Download
memory/1348-63-0x0000000077DA0000-0x0000000077DA2000-memory.dmp

Filesize
8KB

Download
memory/1348-68-0x000007FEFDD50000-0x000007FEFDD52000-memory.dmp

Filesize
8KB

Download
memory/1348-67-0x000007FEFDD50000-0x000007FEFDD52000-memory.dmp

Filesize
8KB

Download
memory/1348-71-0x000007FEFDD60000-0x000007FEFDD62000-memory.dmp

Filesize
8KB

Download
memory/1348-70-0x000007FEFDD60000-0x000007FEFDD62000-memory.dmp

Filesize
8KB

Download
memory/1348-72-0x000000013F560000-0x00000001402A3000-memory.dmp

Filesize
13.3MB

Download