Analysis

  • max time kernel
    123s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2023 17:35

General

  • Target

    file.exe

  • Size

    8.9MB

  • MD5

    887c0911835ace94104d8c570632409a

  • SHA1

    3192b8b83d62a44b22dbdd9f627fde49d16e5350

  • SHA256

    6c54458a3df80f3801df48d60cbafaa64b643f155bdd608140ef508134d52d68

  • SHA512

    f24b3e601874d7f5816f6c5d94598a4e94df6195ad52c32fc716e2c0a7ea518cd6f936722e2eb4654b70d2666365cbd4435bd095633a47d802b6cd1fb41b3bc7

  • SSDEEP

    196608:4Z1+0PfiEOE6NJ8Jkt9KCS1r8ek//fCc3NbFmQLG:4Z1PSEz6GkLS1r8ek/CH4G

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tempCMSc8zTPrtTdn7H\information.txt

    Filesize

    3KB

    MD5

    9ded9afb706530a878758c90b950e288

    SHA1

    d9edfdcd01af7b31d5ed36c8f87500ef99af7a01

    SHA256

    95693c5e0bd4cc42ca2fe9a9b85082ba060704f7e24f756123988c5b74b3e5e0

    SHA512

    71ce54ce9ae3e46c1db7eb51548ce4de6a196728224311f46e9bddaf4c5a1120b2814303bfa9df72a5f19a73f1b5cecbf1bd3a2c4c327dd4ae11491b170d53e3

  • memory/620-70-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-150-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-134-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-59-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-61-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-62-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-63-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-64-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/620-71-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-57-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-129-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-67-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-78-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-79-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-87-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-104-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-114-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/620-119-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/932-56-0x0000000005400000-0x0000000005440000-memory.dmp

    Filesize

    256KB

  • memory/932-69-0x0000000074010000-0x00000000746FE000-memory.dmp

    Filesize

    6.9MB

  • memory/932-54-0x0000000074010000-0x00000000746FE000-memory.dmp

    Filesize

    6.9MB

  • memory/932-55-0x0000000001390000-0x0000000001C88000-memory.dmp

    Filesize

    9.0MB