privateloader | 2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de

General

Target

2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
Size

3.7MB
MD5

f353a6519b5c64d48f798d91e5235848
SHA1

b39fccbe042023d3385cd35eec8d418c700a73f1
SHA256

2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de
SHA512

f6e1c173544b3e898d3f31fd2213e741d1df8857b775c8fb37868f2f4349e37a00a7b3185e1daeb4371757d87c68377a8df7a8411e0aec48552765b52ab9f5f8
SSDEEP

49152:AzkFjR9Z9e5LSe70IVHxtWXq9/Z8UZMPq3/hBfcW:hMYgZHH+qEUW4BfcW

Score

10^/10

privateloader loader

Malware Config

Extracted

Family

privateloader

C2

185.216.70.235

194.49.94.113

91.92.243.151

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Loads dropped DLL 1 IoCs

pid	Process
4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
7	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	4488	WerFault.exe	71

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3848	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	72
PID 4940 wrote to memory of 3848	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	72
PID 4940 wrote to memory of 3848	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	72
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71
PID 4940 wrote to memory of 4488	4940	2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe	71

C:\Users\Admin\AppData\Local\Temp\2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
"C:\Users\Admin\AppData\Local\Temp\2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
  C:\Users\Admin\AppData\Local\Temp\2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
  2⤵
  - Drops file in Program Files directory
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1268
    3⤵
    - Program crash
    PID:632
- C:\Users\Admin\AppData\Local\Temp\2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
  C:\Users\Admin\AppData\Local\Temp\2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de.exe
  2⤵
  PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/4488-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4488-30-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4488-27-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4488-26-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4488-24-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4940-7-0x0000000005BD0000-0x0000000005DC2000-memory.dmp

Filesize
1.9MB

Download
memory/4940-21-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-8-0x0000000005DC0000-0x0000000005F52000-memory.dmp

Filesize
1.6MB

Download
memory/4940-6-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/4940-14-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-15-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-16-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-17-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/4940-18-0x0000000073340000-0x0000000073A2E000-memory.dmp

Filesize
6.9MB

Download
memory/4940-19-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-20-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-1-0x0000000000590000-0x000000000093C000-memory.dmp

Filesize
3.7MB

Download
memory/4940-22-0x0000000006570000-0x0000000006670000-memory.dmp

Filesize
1024KB

Download
memory/4940-23-0x0000000006570000-0x0000000006670000-memory.dmp

Filesize
1024KB

Download
memory/4940-25-0x0000000006570000-0x0000000006670000-memory.dmp

Filesize
1024KB

Download
memory/4940-5-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-4-0x0000000005410000-0x00000000054AC000-memory.dmp

Filesize
624KB

Download
memory/4940-3-0x00000000051D0000-0x0000000005262000-memory.dmp

Filesize
584KB

Download
memory/4940-28-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/4940-2-0x00000000056D0000-0x0000000005BCE000-memory.dmp

Filesize
5.0MB

Download
memory/4940-31-0x0000000073340000-0x0000000073A2E000-memory.dmp

Filesize
6.9MB

Download
memory/4940-0-0x0000000073340000-0x0000000073A2E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing