privateloader | 493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff

Analysis

max time kernel
128s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FIle.exe
Size

675.0MB
MD5

b34566c6cbe042bec91bdf846196b131
SHA1

67f4bf9b318bc129ad67c60e5ab3e461a683f3ac
SHA256

493a03d593db0e285796a53f12cbb0bd23686c45bda99c7e8b38d4c32c65bdff
SHA512

38f50de7a5674f386459bfc5f33a1396f2b1f45a487457cbb30d18dbd5d0723d1c90c3d08d19ed73e40520eb5efa0e1e71769efc2c9490af511ece4bbfb56b0c
SSDEEP

196608:zcl7360bbXb2BAWyMYmjY7WLkJv9DOSFtRNyWai0TckzbHyo2pkdyhjSN:zkKEXb2BAWyMYmYXbT0TcubH8Uy

Score

10^/10

privateloader loader spyware stealer

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

FIle.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation FIle.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ipinfo.io
21 ipinfo.io

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	FIle.exe

flow	ioc
22	ipinfo.io
21	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

FIle.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	FIle.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	FIle.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	FIle.exe
File opened for modification	C:\Windows\System32\GroupPolicy	FIle.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

FIle.exe

pid process

2500 FIle.exe
2500 FIle.exe
2500 FIle.exe
2500 FIle.exe

pid	process
2500	FIle.exe
2500	FIle.exe
2500	FIle.exe
2500	FIle.exe

C:\Users\Admin\AppData\Local\Temp\FIle.exe
"C:\Users\Admin\AppData\Local\Temp\FIle.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/2500-133-0x00007FFD58730000-0x00007FFD58732000-memory.dmp

Filesize
8KB

Download
memory/2500-134-0x00007FFD58740000-0x00007FFD58742000-memory.dmp

Filesize
8KB

Download
memory/2500-135-0x00007FFD58470000-0x00007FFD58472000-memory.dmp

Filesize
8KB

Download
memory/2500-136-0x00007FFD58480000-0x00007FFD58482000-memory.dmp

Filesize
8KB

Download
memory/2500-137-0x00007FFD56220000-0x00007FFD56222000-memory.dmp

Filesize
8KB

Download
memory/2500-138-0x00007FFD56230000-0x00007FFD56232000-memory.dmp

Filesize
8KB

Download
memory/2500-139-0x00007FF7B5150000-0x00007FF7B5E89000-memory.dmp

Filesize
13.2MB

Download
memory/2500-160-0x0000023BC0AF0000-0x0000023BC0B50000-memory.dmp

Filesize
384KB

Download