Overview

overview

10

Static

static

7

8770a893bc...dc.exe

windows7-x64

10

8770a893bc...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2023, 01:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8770a893bc2ac58f0cdc6fc5c9b1499819215a26fbaf7b0915d3d75fefdae0dc.exe

  • Size

    7.4MB

  • MD5

    91073c383c5828128cd16e14223fb59c

  • SHA1

    1b86871962f18400a86e5db8d944a52647ded6b3

  • SHA256

    8770a893bc2ac58f0cdc6fc5c9b1499819215a26fbaf7b0915d3d75fefdae0dc

  • SHA512

    2f8c0a1b56e70bd5494a839afe80ea896ecb90a5f7476191298b1f73351c6d25bd94560cb1517b319802de35ec2bcfa5ce6fe1ad749266b0f89ff059da0c17ee

  • SSDEEP

    196608:7fX5m0N5j9Wj6J/C6tpMcB1c/Sm7hMm71csL:7g0NZ9WOw6tphm7h

Score
10/10
privateloaderloaderspywarestealervmprotect

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8770a893bc2ac58f0cdc6fc5c9b1499819215a26fbaf7b0915d3d75fefdae0dc.exe
    "C:\Users\Admin\AppData\Local\Temp\8770a893bc2ac58f0cdc6fc5c9b1499819215a26fbaf7b0915d3d75fefdae0dc.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1168
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:4008
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:1868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1168-1-0x00007FF76D960000-0x00007FF76E7B8000-memory.dmp

        Filesize

        14.3MB

        Download

      • memory/1168-0-0x00007FFB7E270000-0x00007FFB7E272000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1168-2-0x00007FF76D960000-0x00007FF76E7B8000-memory.dmp

        Filesize

        14.3MB

        Download

      • memory/1168-19-0x00007FF76D960000-0x00007FF76E7B8000-memory.dmp

        Filesize

        14.3MB

        Download

      • memory/1168-24-0x00007FF76D960000-0x00007FF76E7B8000-memory.dmp

        Filesize

        14.3MB

        Download