privateloader | 0d9d7b4f30989ab8a367a11d51971896ca2979bb5e9ad6c36d21493fdd0eab23

Analysis

max time kernel
131s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File.exe
Size

680.0MB
MD5

cd32bc27e4634e5dc2f6c36b1e4cfd48
SHA1

dfd36c9995a2a1d43818851f57ec9d267a7c1273
SHA256

fa23b455384d8ba175c41e3b671f3790d4313ddcf20beff02a3238210804d057
SHA512

dd5b79409bccfceea6c4d88aea62dfff8f043c7b3f56bf88cb6692fd006d84b893cba0dcb8dc59ff59cb98a0ba23884d6dce276226956b717ab71db184a4c44d
SSDEEP

98304:5C+rsvtritV2LJNo2p9RympVBjBTl7uQDz0oYzwfeiImh8RBsJaY4acsB6deoLLb:0+o1riT8JSTiz7Dz0ohfezRmtkKm

Score

10^/10

privateloader loader spyware stealer

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

File.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation File.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ipinfo.io
24 ipinfo.io

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	File.exe

flow	ioc
23	ipinfo.io
24	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

File.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy	File.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	File.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

File.exe

pid process

4808 File.exe
4808 File.exe
4808 File.exe
4808 File.exe

pid	process
4808	File.exe
4808	File.exe
4808	File.exe
4808	File.exe

C:\Users\Admin\AppData\Local\Temp\File.exe
"C:\Users\Admin\AppData\Local\Temp\File.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/4808-133-0x00007FFC47C90000-0x00007FFC47C92000-memory.dmp

Filesize
8KB

Download
memory/4808-134-0x00007FFC47CA0000-0x00007FFC47CA2000-memory.dmp

Filesize
8KB

Download
memory/4808-135-0x00007FFC463F0000-0x00007FFC463F2000-memory.dmp

Filesize
8KB

Download
memory/4808-136-0x00007FFC46400000-0x00007FFC46402000-memory.dmp

Filesize
8KB

Download
memory/4808-137-0x00007FFC454B0000-0x00007FFC454B2000-memory.dmp

Filesize
8KB

Download
memory/4808-138-0x00007FFC454C0000-0x00007FFC454C2000-memory.dmp

Filesize
8KB

Download
memory/4808-139-0x00007FF6C83B0000-0x00007FF6C90F3000-memory.dmp

Filesize
13.3MB

Download
memory/4808-160-0x0000015F195F0000-0x0000015F19699000-memory.dmp

Filesize
676KB

Download
memory/4808-161-0x0000015F195F0000-0x0000015F19699000-memory.dmp

Filesize
676KB

Download