Behavioral task
behavioral1
Sample
2380-2-0x000000013F0D0000-0x000000013FF28000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2380-2-0x000000013F0D0000-0x000000013FF28000-memory.exe
Resource
win10v2004-20230831-en
General
-
Target
2380-2-0x000000013F0D0000-0x000000013FF28000-memory.dmp
-
Size
14.3MB
-
MD5
7f8ef05391beaf004bb481b5973cbb18
-
SHA1
cb6b33952a35fde11b2e8a79183d3bc1401c87ca
-
SHA256
a61c87ad62c5f0c20ef55a2276afdb82b1e828c857e0762e343681b8d3edac54
-
SHA512
48899d11f7c97ab26ea2331314c5cc2e4965dda994c6e1492c412453e1cd007bd3591765891c48bf0d71b90f48dd42f7fd460f13d3839dd86a4af705c54dd374
-
SSDEEP
196608:/QvwDsd6nCFIEDB+X+mq4sucNfX5m0N5j9Wj6J/C6tpMcB1c/Sm7h2A71wod:ISQjAXPcNg0NZ9WOw6tphm7h
Malware Config
Signatures
-
Privateloader family
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2380-2-0x000000013F0D0000-0x000000013FF28000-memory.dmp
Files
-
2380-2-0x000000013F0D0000-0x000000013FF28000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 757KB - Virtual size: 797KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ